ci: add id-token: write to caller permissions

Required for hanzoai/.github/.github/workflows/docker-build.yml@main —
without it the workflow_call dies as startup_failure with no jobs
dispatched. Caller permissions are a CEILING.

.github/workflows/docker-publish.yml

@@ -10,6 +10,11 @@ concurrency:
   group: docker-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
 jobs:
   docker:
     uses: hanzoai/.github/.github/workflows/docker-build.yml@main