fix(ci): grant E2E permissions to release workflows

[pimlock]

Summary

Restore Release Dev workflow startup by granting the reusable E2E workflow the token permissions it requests. Apply the same fix to Release Tag so the next tagged release does not hit the latent startup failure.

The regression was introduced by #2311, which added artifact downloads and actions: read to .github/workflows/e2e-test.yml but updated only the branch and merge-queue caller permissions. Release Dev has failed at startup since that merge: https://github.com/NVIDIA/OpenShell/actions/runs/29770548461

Related Issue

Follow-up to #2311. No issue.

Changes

• Grant actions: read, contents: read, and packages: read to the Release Dev E2E caller
• Grant the same least-privilege permissions to the identically affected Release Tag E2E caller
• Leave merge-queue E2E configuration unchanged because it already grants the required permissions

Testing

• mise run pre-commit passes
• Unit tests added/updated (not applicable; workflow permissions only)
• E2E tests added/updated (not applicable; workflow permissions only)
• Parsed the modified workflow YAML and verified caller permissions satisfy the reusable workflow permissions
• git diff --check passes

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; workflow permissions only)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2376.docs.buildwithfern.com/openshell