ci: declare per-workflow permissions and move registry creds to environments

[jsokol]

Housekeeping so the repo-level default GITHUB_TOKEN can be set to read-only, plus a move of the registry credentials onto environments.

Per-workflow permissions:

Every workflow now declares one explicitly. create_new_tag.yml is the only one that needs contents: write (it tags and pushes tags); the rest are contents: read.

One detail worth a second look: push-to-gh-pkgs.yml grants packages: write + id-token: write at the caller level. A reusable workflow can only downgrade the caller's token, never escalate — so with a bare contents: read caller, the callee's ghcr.io push and cosign sign would both fail. The callee's own job-level block is unchanged.

Registry credentials → environments

The jobs that use the Docker Hub credentials now declare an environment, so those credentials are environment-scoped with a deployment-branch policy instead of repo-wide:

workflow	environment	allowed ref
publish-testing.yml	testing	testing
promote-latest.yml	release	master
push-to-dockerhub_rw.yml	release	master

release also carries a required reviewer, so a GA promotion waits on one approval. This lines up with how the AWS OIDC roles are already scoped — simplerisk-image-promoter-latest and -testing pin their sub to refs/heads/master and refs/heads/testing.

Ordering note for whoever merges

The environments exist but hold no values yet — secret values can't be copied programmatically. Sequence matters:

1. Populate DOCKER_USERNAME + DOCKER_TOKEN on both the release and testing environments.
2. Merge this PR.
3. Remove the repo-level DOCKER_USERNAME / DOCKER_TOKEN.
4. Set Settings → Actions → Workflow permissions to Read repository contents.

Doing 3 before 1 will fail the next publish-testing run.

🤖 Generated with Claude Code