Fixup release workflow

Author: gregmagolan

.github/workflows/release.yml

@@ -1,10 +1,16 @@
 name: Release
+
 on:
   # Allow manual testing by invoking this workflow from the GH web UI
   workflow_dispatch:
   push:
     tags:
       - '202*.*.*'
+
+permissions:
+  contents: write  # Required for creating releases and generating notes
+  pull-requests: read  # Pull from PRs (e.g., titles, labels)
+
 jobs:
   build_all:
     uses: ./.github/workflows/build.yaml