Add explicit permissions to approval-gate job in production deployment workflow

[Copilot]

CodeQL alert #8 flagged the approval-gate job for inheriting overly broad default GITHUB_TOKEN permissions instead of declaring explicit constraints.

Changes:

• Added permissions: contents: read to the approval-gate job in .github/workflows/deploy.yml
• Job only prints deployment context and requires no write access
• deploy job retains existing id-token: write + contents: read for OIDC authentication

approval-gate:
  needs: pre-approval-checks
  if: github.event_name != 'pull_request'
  runs-on: ubuntu-latest
  permissions:
    contents: read
  environment:
    name: PROD-approval

This enforces least-privilege principle without altering workflow behavior.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Copilot wasn't able to review any files in this pull request.