fix(ci): correct reusable-workflow caller permissions and inputs (#755)

Two proven fatal classes, both confirmed by GitHub's own error text:

1. `permissions:` **nested under `with:`** — it is read as a workflow
*input*, and undeclared inputs are rejected at creation (`Invalid input,
toolchain is not defined in the referenced workflow` — januskey run
34410358241). The block is moved to job level, and the undeclared
`toolchain` input is dropped (rust-ci-reusable declares
runs-on/enable_audit/enable_coverage/coverage_floor/clippy_args/test_args/check_args/working_directory).
2. Caller granting fewer permissions than the callee declares — `Error
calling workflow … requesting '<perm>', but is only allowed '<none>'`.
The job now grants the canonical `actions: read`, `contents: read`,
`security-events: write`.

Verified with `git apply --check` against current `main` before opening.

Author: hyperpolymath

.github/workflows/spark-theatre-gate.yml

@@ -31,7 +31,7 @@ jobs:
     with:
       paths: "."
       enforce_zero_contract: false
-      permissions:
-        actions: read
-        contents: read
-        security-events: write
+    permissions:
+      actions: read
+      contents: read
+      security-events: write