Fix release notes

.github/workflows/release-notes.yml

@@ -27,9 +27,7 @@ jobs:
 
           ## Command line
 
-          \`\`\`sh
-          cargo install strix-firewall
-          \`\`\`
+          **Command-line installs do not include machine-wide screening.**
 
           \`\`\`sh
           curl --proto '=https' --tlsv1.2 -LsSf $url/strix-firewall-installer.sh | sh

.github/workflows/release.yml

@@ -302,8 +302,7 @@ jobs:
     secrets: inherit
     # publish jobs get escalated permissions
     permissions:
-      "id-token": "write"
-      "packages": "write"
+      "contents": "read"
 
   announce:
     needs:

dist-workspace.toml

@@ -14,3 +14,6 @@ post-announce-jobs = ["./release-notes"]
 global-artifacts-jobs = ["./build-macos-pkg"]
 github-build-setup = "../build-setup.yml"
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
+
+[dist.github-custom-job-permissions]
+"publish-crates" = { contents = "read" }