fix(ci): grant ai-bundles reusable call its required token scopes

The Release workflow failed at startup ("workflow file issue", no jobs
created) whenever dispatched. Root cause: release.yml sets top-level
`permissions: {}`, so the ai-bundles reusable-workflow call inherited an
empty scope set. ai-bundles.yml's jobs declare `contents: read` /
`packages: read`, and GitHub rejects a called workflow requesting scopes
the caller never granted -- validated at startup, before any job runs, so
the whole run fails immediately regardless of the job's `if:`.

Grant the two scopes on the call job. Confirmed on a throwaway branch: a
neutralized dispatch went from startup_failure to a clean run with
ai-bundles correctly skipped.

This unblocks every real release; main's release.yml could not start.

.github/workflows/release.yml

@@ -380,6 +380,14 @@ jobs:
     name: AI Bundles
     needs: [release, docker]
     if: needs.release.outputs.new_version
+    # The top-level `permissions: {}` default means this reusable-workflow call
+    # grants no token scopes by default. ai-bundles.yml's jobs declare
+    # `contents: read` / `packages: read`, and GitHub rejects a called workflow
+    # requesting scopes the caller never granted -- failing at startup before any
+    # job runs. Grant them here so the call passes startup validation.
+    permissions:
+      contents: read
+      packages: read
     uses: ./.github/workflows/ai-bundles.yml
     with:
       version: ${{ needs.release.outputs.new_version }}