fix: add missing environment variables and permissions to Primary CI

- Add GOOGLE_SHEETS_API_KEY, GSHEETS_SA_KEY, and GITHUB_TOKEN to Primary CI workflow
- Add permissions section for proper secret access
- Ensures Group 5 CI tests can validate external service connectivity
- Resolves external-services.test.ts failures in Primary CI workflow

Required: Repository secrets must be configured in GitHub Settings → Secrets and variables → Actions:
- GOOGLE_SHEETS_API_KEY: Google Sheets API key for vocabulary validation
- GSHEETS_SA_KEY: Base64-encoded Google service account key

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

Author: jonphipps

.github/workflows/nx-optimized-ci.yml

@@ -15,6 +15,10 @@ on:
         default: 'false'
         type: boolean
 
+permissions:
+  actions: read
+  contents: read
+  
 env:
   NX_BRANCH: ${{ github.event.number || github.ref_name }}
   NX_RUN_GROUP: ${{ github.run_id }}
@@ -26,6 +30,10 @@ env:
   SITE_TAGLINE: International Federation of Library Associations and Institutions
   # Skip Nx cache if requested via workflow dispatch
   NX_SKIP_NX_CACHE: ${{ inputs.skip_nx_cache == 'true' && 'true' || '' }}
+  # Environment variables for Group 5 CI tests
+  GOOGLE_SHEETS_API_KEY: ${{ secrets.GOOGLE_SHEETS_API_KEY }}
+  GSHEETS_SA_KEY: ${{ secrets.GSHEETS_SA_KEY }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   ci: