fix CI npm cache write denied under restricted GITHUB_TOKEN

[proxymeshai]

Summary

Confirmed npm and JSR both successfully published 0.2.4 (publish job concluded success). The annotation on Post Setup Node was a cache-save warning, not a publish failure:

cache write denied: token has no writable scopes

Cause

publish.yml (and proxy_integration_tests.yml) set explicit least-privilege permissions with only contents: read. That allows cache restore but not reserve/write when actions/setup-node uses cache: npm.

Fix

Add actions: write so setup-node can save the npm cache:

• .github/workflows/publish.yml
• .github/workflows/proxy_integration_tests.yml

actionlint passes on the updated workflows.

Slack Thread

  

[cursor]

Not approved: this is a CI workflow permission change, not a Dependabot version bump or security update, so it needs human review. Cursor Bugbot passed with no findings; Cursor Security Agent was not running. Assigned a reviewer.

  

_{Sent by Cursor Approval Agent: dependabot approver}