Add packages:read permission for container access

Tag-triggered workflows may need explicit package permission to pull
from GHCR.

Author: mmcky

.github/workflows/publish.yml

@@ -8,6 +8,7 @@ permissions:
   contents: read
   pages: write
   id-token: write
+  packages: read
 
 concurrency:
   group: "pages"