fix: [INFRA-629] Fix bundle permissions

[alexs-aero]

This PR fixes additional permission issues introduced in the process of implementing MAVEN GAV scanning and metadata upload.

Additionally, workflow audit was conducted to double check similar permission need in other shared workflows

Summary

• Scope actions: read to the create-release-bundle job in reusable_create-release-bundle.yaml (same pattern as PR fix: [INFRA-629] Fix permissions for metadata upload #267 deploy fix) so composable callers with only contents: read + id-token: write no longer hit startup_failure.
• Add permission regression tests: local bats checker, CI workflow for static scoping, and composable minimal-permissions integration workflow (sign → deploy → create-release-bundle).
• Update create-release-bundle and CICD docs with caller permission notes.