[CI] Grant id-token to benchmark wheel-build jobs for Sigstore signing

PR #7840 added a keyless Sigstore signing step to the reusable
build-benchmarks-wheel.yml, which requires `id-token: write`. The
workflows that call it only granted `permissions: read-all`, which
excludes id-token. A reusable workflow cannot request more token
permissions than its caller, so every triggered benchmark workflow
failed at startup validation ("workflow file issue", startup_failure)
with zero jobs.

Add a job-level `permissions` block granting `contents: read` and
`id-token: write` on each build-wheel job that calls the reusable
signing workflow, leaving `read-all` intact for all other jobs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: quinnlp

.github/workflows/on-label.yml

@@ -84,6 +84,9 @@ jobs:
       contains(github.event.pull_request.labels.*.name, 'run-benchmarks') ||
       contains(github.event.pull_request.labels.*.name, 'run-vllm-benchmarks') ||
       contains(github.event.pull_request.labels.*.name, 'run-sglang-benchmarks')
+    permissions:
+      contents: read
+      id-token: write   # for Sigstore signing in the called workflow
     uses: ./.github/workflows/build-benchmarks-wheel.yml
     with:
       python-version: "3.12"

.github/workflows/sglang-benchmarks-bmg.yml

@@ -22,6 +22,9 @@ concurrency:
 
 jobs:
   build-wheel:
+    permissions:
+      contents: read
+      id-token: write   # for Sigstore signing in the called workflow
     uses: ./.github/workflows/build-benchmarks-wheel.yml
     with:
       python-version: "3.12"

.github/workflows/sglang-benchmarks-pvc.yml

@@ -22,6 +22,9 @@ concurrency:
 
 jobs:
   build-wheel:
+    permissions:
+      contents: read
+      id-token: write   # for Sigstore signing in the called workflow
     uses: ./.github/workflows/build-benchmarks-wheel.yml
     with:
       python-version: "3.12"

.github/workflows/triton-benchmarks-bmg.yml

@@ -17,6 +17,9 @@ on:
 
 jobs:
   build-wheel:
+    permissions:
+      contents: read
+      id-token: write   # for Sigstore signing in the called workflow
     uses: ./.github/workflows/build-benchmarks-wheel.yml
     with:
       python-version: "3.12"

.github/workflows/triton-benchmarks-pvc.yml

@@ -17,6 +17,9 @@ on:
 
 jobs:
   build-wheel:
+    permissions:
+      contents: read
+      id-token: write   # for Sigstore signing in the called workflow
     uses: ./.github/workflows/build-benchmarks-wheel.yml
     with:
       python-version: "3.12"

.github/workflows/vllm-benchmarks-bmg.yml

@@ -23,6 +23,9 @@ concurrency:
 
 jobs:
   build-wheel:
+    permissions:
+      contents: read
+      id-token: write   # for Sigstore signing in the called workflow
     uses: ./.github/workflows/build-benchmarks-wheel.yml
     with:
       python-version: "3.12"

.github/workflows/vllm-benchmarks-pvc.yml

@@ -23,6 +23,9 @@ concurrency:
 
 jobs:
   build-wheel:
+    permissions:
+      contents: read
+      id-token: write   # for Sigstore signing in the called workflow
     uses: ./.github/workflows/build-benchmarks-wheel.yml
     with:
       python-version: "3.12"