fix(ci): grant contents write permission for beachball publish push

When `id-token: write` was added for trusted npm publishing (OIDC),
specifying `permissions` at the job level overrides all defaults.
`contents` dropped from `write` to `read`, breaking beachball's
`git push` after publish.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: frantic1048

.github/workflows/ci.yml

@@ -83,7 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       id-token: write
-      contents: read
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4