ci(windows-installer): add explicit permissions block

  Address CodeQL actions/missing-workflow-permissions finding. Least-
  privilege at workflow level: contents: write is required by
  softprops/action-gh-release to attach the installer .exe to a tag
  release; all other steps are read-only.

.github/workflows/windows-installer.yml

@@ -16,6 +16,14 @@ on:
       - 'v*'
   workflow_dispatch:
 
+# Least-privilege per CodeQL actions/missing-workflow-permissions.
+# contents: write is required by softprops/action-gh-release to attach
+# the .exe to a tag release; the manual-dispatch path doesn't trigger
+# that step and could run with read-only, but a single workflow-level
+# block keeps the surface auditable in one place.
+permissions:
+  contents: write
+
 jobs:
   build:
     runs-on: windows-latest