[sec-check] fix: declare top-level permissions: {} in pr-e2e.yml

[kubestellar-hive]

Security Fix

Adds an explicit top-level permissions: {} to: pr-e2e.yml

Each workflow already declares least-privilege permissions at the job level (verified: every job has its own block). The top-level nil default means any future job added without a permissions block gets an empty token instead of inheriting the repository default (potentially write).

Fixes #506

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=kimi-k3 copilot=1.0.59

[hanthor]

Verified and approving.

I checked the claim in the body rather than taking it on faith — pr-e2e.yml has exactly two jobs and both declare their own block:

• compose (L27) → contents: read, packages: write
• e2e (L90) → contents: read, packages: write, and it calls ./.github/workflows/run-testsuite.yml as a reusable workflow, so the called workflow inherits the caller job's permissions rather than the top-level default. Adding permissions: {} therefore changes nothing for the current jobs and correctly fails-closed for any job added later without its own block.

On the red Lint & syntax check — not caused by this PR, and not fixable here. It is the pre-existing Containerfile:13 DL3063 warning: stage name should not be a reserved word (hadolint flags context as a reserved BuildKit named-context). I reproduced it locally against main's Containerfile and confirmed the context → ctx rename clears it.

That rename landed in #501, which merged to testing at 2026-08-09T02:07Z. This PR targets main, and main line 13 is still FROM scratch AS context, so the check will stay red until the testing→main promotion carries #501 across. Nothing to do on this branch — it should go green on its own once promotion runs.