fix(ci): least-privilege permissions + fork-safe concurrency keys

- evals.yml / evals-periodic.yml evals jobs: explicit contents:read +
  packages:read (container-image pull) and persist-credentials:false —
  the jobs that execute PR-authored code with three provider API keys
  ran on the repo-default token grant with the token written into
  .git/config
- permissions blocks for the 4 workflows that had none (skill-docs,
  make-pdf-gate, windows-free-tests, windows-setup-e2e)
- fork-safe concurrency keys: actionlint, skill-docs, make-pdf-gate,
  windows-setup-e2e switch from head_ref to PR-number keying — a bare
  branch name carries no fork prefix, so same-name branches from two
  forks shared one group and cancelled each other's runs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/skill-docs.yml

@@ -10,9 +10,16 @@ on:
 # windows-free-tests.yml, etc.). head_ref is set on pull_request; ref_name is
 # the fallback for push so a rapid push series doesn't pile up stale runs.
 concurrency:
-  group: skill-docs-${{ github.head_ref || github.ref_name }}
+  # PR-number keyed (run_id fallback for push/dispatch): a bare branch name
+  # carries no fork prefix, so same-name branches from two forks would share
+  # one group and cancel each other's runs (same rationale as free-tests.yml).
+  group: skill-docs-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+# The job only reads the checkout and runs the generator — no token writes.
+permissions:
+  contents: read
+
 jobs:
   check-freshness:
     runs-on: ubicloud-standard-2