ci: add id-token: write to caller permissions

Required for hanzoai/.github/.github/workflows/docker-build.yml@main —
without it the workflow_call dies as startup_failure with no jobs
dispatched. Caller permissions are a CEILING.

.github/workflows/docker-release.yml

@@ -17,6 +17,11 @@ concurrency:
   group: docker-${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
 jobs:
   # Gate: only proceed if CI passed (skip check for tags/manual)
   gate: