squash-me, permissions for workflow

ci/gen_gha_matrix_jobs.py

@@ -110,6 +110,7 @@ def write_github_workflow_file(tree: dict[str, list[str]], path: pathlib.Path) -
 
     workflow = {
         "name": "Build Notebooks",
+        # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
         "permissions": {
             "packages": "write",
         },