chore(ci): use id-token write for whole job

Trusted publishing asks for this explicitly; the job-specific case might not be supported.

Author: JasonWeinzierl

.github/workflows/publish.yml

@@ -4,6 +4,10 @@ on:
     types:
       - published
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   check:
     uses: ./.github/workflows/ci.yml
@@ -14,10 +18,6 @@ jobs:
 
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: read
-      id-token: write # Required for OIDC
-
     steps:
       - name: Checkout
         uses: actions/checkout@v5