fix(ci): grant contents:read so desktop builds can clone the internal fork

The reusable build jobs ran with permissions: {} (fine for upstream's public
repo, which checks out with no token). This fork is internal, so checkout failed
with 'Repository not found'. Grant contents:read on the linux/macos/windows
caller jobs and the reusable build jobs, mirroring the prepare job.

.github/workflows/build-healthchat-desktop.yaml

@@ -157,6 +157,8 @@ jobs:
     linux:
         name: Linux ${{ matrix.arch }}
         needs: prepare
+        permissions:
+            contents: read
         strategy:
             matrix:
                 arch: [amd64, arm64]
@@ -171,6 +173,8 @@ jobs:
     macos:
         name: macOS
         needs: prepare
+        permissions:
+            contents: read
         uses: ./.github/workflows/build_desktop_macos.yaml
         secrets: inherit # zizmor: ignore[secrets-inherit]
         with:
@@ -183,6 +187,8 @@ jobs:
     windows:
         name: Windows ${{ matrix.arch }}
         needs: prepare
+        permissions:
+            contents: read
         strategy:
             matrix:
                 arch: [x64, arm64]

.github/workflows/build_desktop_linux.yaml

@@ -76,6 +76,9 @@ jobs:
         # We build on native infrastructure as matrix-seshat fails to cross-compile properly
         # https://github.com/matrix-org/seshat/issues/135
         runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
+        # contents:read so the checkout can clone the fork when it is a private/internal repo
+        permissions:
+            contents: read
         env:
             HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-web/desktop-build-env:${{ case(github.event_name == 'push', inputs.ref || github.ref_name, github.event_name == 'release', 'staging', 'develop') }}
         steps:

.github/workflows/build_desktop_macos.yaml

@@ -76,6 +76,9 @@ jobs:
         name: Build macOS Universal
         runs-on: macos-26 # M1
         environment: ${{ inputs.sign && 'Desktop Apple' || '' }}
+        # contents:read so the checkout can clone the fork when it is a private/internal repo
+        permissions:
+            contents: read
         steps:
             - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
               with:

.github/workflows/build_desktop_windows.yaml

@@ -86,6 +86,9 @@ jobs:
         name: Build Windows ${{ inputs.arch }}
         runs-on: windows-2025
         environment: ${{ inputs.sign && 'Desktop eSigner' || '' }}
+        # contents:read so the checkout can clone the fork when it is a private/internal repo
+        permissions:
+            contents: read
         env:
             SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x86/signtool.exe"
         steps: