security: add missing workflow permissions blocks

[BreakableHoodie]

Summary

Adds top-level permissions: contents: read to python-gen-worksheets.yml which was missing an explicit permissions declaration.

Without an explicit permissions: block, the workflow inherits the default token permissions. contents: read is the correct minimal scope — this workflow only checks out code and runs Python/pip commands.

Resolves actions/missing-workflow-permissions code scanning alerts.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[BreakableHoodie]

CI Status

The deploy failure is pre-existing and unrelated to this PR:

<Error><Code>BlobNotFound</Code><Message>The specified blob does not exist.</Message></Error>

This same Azure BlobNotFound error is already failing on master before this branch was created. The deployment target is missing or misconfigured independently of the permissions: contents: read change here.

All other checks pass. This PR is safe to merge.