chore(CI): fix missing permission for provenance

[chenjiahan]

Summary

Provenance generation in GitHub Actions requires "write" access to the "id-token" and I should not delete it.

I have added comment to prompt the role of this permission.

Checklist

• Tests updated (or not required).
• Documentation updated (or not required).

[netlify]

✅ Deploy Preview for rsbuild ready!

Name	Link
🔨 Latest commit	b8d59f5
🔍 Latest deploy log	https://app.netlify.com/sites/rsbuild/deploys/676a7ed73f0d4e00089c0d7d
😎 Deploy Preview	https://deploy-preview-4257--rsbuild.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 81 (🟢 up 7 from production) Accessibility: 97 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: 60 (no change from production) View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify site configuration.