fix(parse): always emit permissions: {} in workflow YAML output

[jccguimaraes]

When no permissions block is present in HCL, the workflow now emits permissions: {} (deny all) rather than omitting the key. An empty permissions {} block already emitted {} after the previous fix, but the global ": {}\n" → ":\n" post-processor in marshalWorkflowYAML was silently erasing it. Fixed with a sentinel-swap that protects permissions: {} through the strip.

All 14 affected golden fixtures updated. Explicit unit tests added (TestParsePermissionsDefault) covering: no block, empty block, and scoped permissions.

[github-actions]

Go test coverage: 64.9% for commit 827fa38

⚠️ 1 of 19 packages have zero coverage.

• github.com/yldio/cinzel/internal/test

View coverage for all packages

# Package Name                                     | Coverage
+ github.com/yldio/cinzel                          |    80.0%
+ github.com/yldio/cinzel/internal/ai              |    46.8%
+ github.com/yldio/cinzel/internal/cinzelerror     |    18.2%
+ github.com/yldio/cinzel/internal/command         |    39.5%
+ github.com/yldio/cinzel/internal/filereader      |    50.0%
+ github.com/yldio/cinzel/internal/filewriter      |    88.9%
+ github.com/yldio/cinzel/internal/fsutil          |    68.0%
+ github.com/yldio/cinzel/internal/hclparser       |    62.7%
+ github.com/yldio/cinzel/internal/maputil         |    93.3%
+ github.com/yldio/cinzel/internal/naming          |    93.1%
+ github.com/yldio/cinzel/internal/pin             |    54.8%
- github.com/yldio/cinzel/internal/test            |     0.0%
+ github.com/yldio/cinzel/internal/yamlwriter      |    88.9%
+ github.com/yldio/cinzel/provider/github          |    69.5%
+ github.com/yldio/cinzel/provider/github/action   |    82.1%
+ github.com/yldio/cinzel/provider/github/job      |    92.6%
+ github.com/yldio/cinzel/provider/github/step     |    69.3%
+ github.com/yldio/cinzel/provider/github/workflow |    85.6%
+ github.com/yldio/cinzel/provider/gitlab          |    63.5%