Grant contents: write to the android nightly caller job

GitHub statically validates the reusable-workflow permission ceiling, so
calling build-submit-android.yml fails validation because its attachToRelease
job requests contents: write while the nightly caller only granted read. That
job is skipped for nightly builds (it needs a production tag), but the check
runs at parse time regardless. Scope the write permission to the android
caller job so the rest of the workflow stays read-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/nightly-build.yml

@@ -84,6 +84,11 @@ jobs:
   android:
     name: Nightly Android Build
     needs: [prepare]
+    # build-submit-android.yml contains an attachToRelease job that requests contents: write.
+    # That job is skipped for nightly (it needs a production tag build), but GitHub statically
+    # validates the reusable-workflow permission ceiling, so the caller must grant it here.
+    permissions:
+      contents: write
     uses: ./.github/workflows/build-submit-android.yml
     with:
       profile: testflight-android