ci: grant pull-requests: read where paths-filter needs it

Declaring a `permissions:` block sets every unlisted scope to none, which
dropped `pull-requests` for the six workflows whose file-changes job runs
dorny/paths-filter. That action defaults to `token: ${{ github.token }}`
and reads the PR's changed-file list via pulls.listFiles on pull_request
events, so it needs pull-requests: read. test.yml also passes
`list-files: shell`, which depends on that list directly.

Applied to exactly the six paths-filter users: bench, cleanliness,
convergence, coverage, fp-stability, test. The other nine workflows
reference no GitHub API beyond contents and stay at contents: read.

Claude-Session: https://claude.ai/code/session_01XPqfEaUBG7ZaZVzeMWnKHd

Author: sbryngelson

.github/workflows/bench.yml

@@ -11,8 +11,11 @@ concurrency:
   cancel-in-progress: true
 
 # Least-privilege default: no job in this workflow writes to the repo.
+# pull-requests: read is required by dorny/paths-filter, which reads the PR's
+# changed-file list through the API on pull_request events.
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   file-changes:

.github/workflows/cleanliness.yml

@@ -11,8 +11,11 @@ concurrency:
   cancel-in-progress: true
 
 # Least-privilege default: no job in this workflow writes to the repo.
+# pull-requests: read is required by dorny/paths-filter, which reads the PR's
+# changed-file list through the API on pull_request events.
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   file-changes:

.github/workflows/convergence.yml

@@ -11,8 +11,11 @@ env:
   OMPI_MCA_rmaps_base_oversubscribe: 1
 
 # Least-privilege default: no job in this workflow writes to the repo.
+# pull-requests: read is required by dorny/paths-filter, which reads the PR's
+# changed-file list through the API on pull_request events.
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   file-changes:

.github/workflows/coverage.yml

@@ -12,8 +12,11 @@ concurrency:
   cancel-in-progress: true
 
 # Least-privilege default: no job in this workflow writes to the repo.
+# pull-requests: read is required by dorny/paths-filter, which reads the PR's
+# changed-file list through the API on pull_request events.
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   file-changes:

.github/workflows/fp-stability.yml

@@ -36,8 +36,11 @@ on:
   workflow_dispatch:
 
 # Least-privilege default: no job in this workflow writes to the repo.
+# pull-requests: read is required by dorny/paths-filter, which reads the PR's
+# changed-file list through the API on pull_request events.
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   file-changes:

.github/workflows/test.yml

@@ -13,8 +13,11 @@ concurrency:
   cancel-in-progress: ${{ github.event_name != 'push' }}
 
 # Least-privilege default: no job in this workflow writes to the repo.
+# pull-requests: read is required by dorny/paths-filter, which reads the PR's
+# changed-file list through the API on pull_request events.
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   lint-gate: