ci: scope validate-openapi workflow token to read-only

[dmchaledev]

Summary

• .github/workflows/validate-openapi.yml had no permissions: block, so the Spectral lint job ran with whatever the repo's default GITHUB_TOKEN permissions happen to be, rather than an explicit least-privilege scope.
• The job only checks out the repo and lints the OpenAPI specs — it never needs to write anything — so it should be scoped to contents: read, matching the explicit, minimal scoping deploy-docs.yml already uses (contents: read, pages: write, id-token: write).
• This is a one-line hardening change (an OpenSSF Scorecard "Token-Permissions" style fix) with no functional impact on the lint job itself.

Pre-flight duplicate check

• I searched open issues and open PRs for changes to the same file(s) and did not find an existing one already covering this change. The only open issue (sat/openapi.yaml: several write endpoints are missing a requestBody schema #39) is about SAT spec content (request bodies/servers block), unrelated to this workflow. The 5 open PRs are all Dependabot GitHub Actions version bumps, unrelated to this permissions change.

Related issues/PRs

None.

Testing

• Validated the workflow file still parses as valid YAML after the change.
• No behavior change expected: the job doesn't perform any write operations, so scoping the token to contents: read should have no effect on lint results.

---

Generated by Claude Code