Potential fix for code scanning alert no. 3: Workflow does not contain permissions

[itallstartedwithaidea]

Potential fix for https://github.com/itallstartedwithaidea/ContextOS/security/code-scanning/3

In general, the fix is to add an explicit permissions section to the workflow (or the specific job) that grants only the scopes required. This job needs to be able to read and write repository contents to commit and push, and it doesn’t use any other GitHub resources, so contents: write is sufficient.

The best fix without changing functionality is:

• Add a permissions block under the sync job (or at the top level).
• Set contents: write so that git push using GITHUB_TOKEN continues to work.
• Do not add any extra permissions (like issues or pull-requests) since they are not used.

Concretely, in .github/workflows/sync-upstream-docs.yml, under jobs: sync:, insert:

    permissions:
      contents: write

indented to align with runs-on. No imports or additional definitions are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.