ci: add id-token: write to caller permissions

Required for hanzoai/.github/.github/workflows/docker-build.yml@main —
without it the workflow_call dies as startup_failure with no jobs
dispatched. Caller permissions are a CEILING.

.github/workflows/docker-publish.yml

@@ -7,6 +7,11 @@ on:
   # No pull_request trigger — prevents fork PRs from running on self-hosted runners
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
 jobs:
   docker:
     uses: hanzoai/.github/.github/workflows/docker-build.yml@main