ci: tighten build permissions and CodeQL path coverage

Limit the build workflow token to contents:read by default, and
include lang/** so language-tooling changes trigger CodeQL.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/build-and-release.yml

@@ -52,6 +52,9 @@ on:
       - 'var/macos/**'
       - 'var/windows/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/codeql-analysis.yml

@@ -18,6 +18,7 @@ on:
       - '.github/workflows/codeql-analysis.yml'
       - 'frontend/**'
       - 'integration-tests/**'
+      - 'lang/**'
       - 'proto/**'
       - 'service/**'
     branches: [main, next]
@@ -26,6 +27,7 @@ on:
       - '.github/workflows/codeql-analysis.yml'
       - 'frontend/**'
       - 'integration-tests/**'
+      - 'lang/**'
       - 'proto/**'
       - 'service/**'
     branches: [main, next]