ci: grant GITHUB_TOKEN packages: write for ghcr push

The workflow has no permissions block, so GITHUB_TOKEN inherits the
repo's read-only default and cannot create the ghcr.io package
('denied: installation not allowed to Create organization package').
Grant contents: read + packages: write per GitHub's documented pattern
for publishing packages via GITHUB_TOKEN.

.github/workflows/build-docker.yaml

@@ -1,6 +1,9 @@
 name: Multiplatform Docker build & push
 on:
   push:
+permissions:
+  contents: read
+  packages: write
 jobs:
   build:
     env: