feat: update releases to be sea's

[cpendery]

No description provided.

In general, this should be fixed by explicitly declaring a permissions block to limit what the GITHUB_TOKEN can do. The safest and simplest approach is to set permissions at the workflow root so it applies to all jobs that don’t override it. For this workflow, we can restrict contents to read, which is sufficient for actions/checkout and all subsequent build/packaging steps, and no other permissions are needed.

Concretely, in .github/workflows/pkg.yml, add a root-level permissions: block between the name: and on: keys. This block will look like:

permissions:
  contents: read

No other changes to jobs or steps are required. This does not change any existing functionality, because none of the steps rely on write access to repository contents or other resources; it only reduces the potential impact if a job is compromised.

In general, the fix is to explicitly define a permissions block that restricts the GITHUB_TOKEN to the minimal scopes necessary. Because this workflow only checks out code, installs dependencies, builds/packages, and uploads/downloads artifacts, it only requires read access to repository contents; it does not need to write to issues, pull requests, or repository contents. The best fix is to add a permissions block at the root of the workflow so it applies to all jobs (build and combine) without altering their behavior.

Concretely, in .github/workflows/pkg.yml, insert a permissions: section after the name: Package line (line 1) and before the on: block. Set contents: read as a safe minimal scope. No additional imports or methods are required; this is purely a YAML configuration change to the workflow file. The jobs and steps remain unchanged.