ci(publish): grant write permissions to changesets job

GITHUB_TOKEN defaulted to read-only, so the changeset-release branch push
hit a 403. Grant contents + pull-requests write.

Author: DizzyMii

.github/workflows/publish.yml

@@ -9,6 +9,9 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # push the changeset-release branch + create release tags
+      pull-requests: write # open the "Version Packages" PR
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v3