fix: add permissions for reusable publish-preview workflow

[cryptodev-2s]

Explanation

The reusable publish-preview workflow from github-tools requires contents: read (checkout) and pull-requests: write (PR comment). MetaMask's org restricts default token permissions to read-only, so these must be explicitly declared by the caller.

References

• Fixes workflow validation error from chore: use reusable publish-preview workflow from github-tools #8233

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Low risk: only updates workflow permissions, with no product code or runtime logic changes.

Overview
Ensures the reusable publish-preview GitHub Actions workflow can run under restricted org defaults by explicitly granting contents: read (checkout) and pull-requests: write (PR commenting) permissions.

^{Written by Cursor Bugbot for commit cd67686. This will update automatically on new commits. Configure here.}