ci: grant contents/issues write to changelog workflow call

The repo default GITHUB_TOKEN is read-only, so the reusable changelog
workflow's requested permissions exceeded the caller's and every run
failed at startup. Scope the grant to the calling job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: andinux

.github/workflows/changelog.yml

@@ -13,6 +13,11 @@ on:
 
 jobs:
   release:
+    # Repo default is read-only; the called workflow needs write, and a reusable
+    # workflow can never hold more than its caller.
+    permissions:
+      contents: write
+      issues: write
     # Pin to a reviewed release tag (or, strongest, a full commit SHA) — not @main. See "Security" below.
     uses: sqlitecloud/changelog-action/.github/workflows/action.yml@v1
     with: