[sr-dev] git:master:ddb39dd0: build: harden main.yml permissions