ci: align qualification declarations

[stefan-jansen]

Summary

• name CPython 3.12, 3.13, and 3.14 explicitly in the README
• set the Docs workflow default permission to read-only repository contents
• preserve the existing job-level permission and workflow behavior

Verification

• uv run ruff check src tests scripts
• uv run ruff format --check src tests scripts
• uv run ty check
• uv run pytest (382 passed, 100% coverage)
• uv run mkdocs build --strict
• README quick-start and link checks
• uv build and uv run twine check
• pre-commit run --all-files
• actionlint .github/workflows/docs.yml
• direct collector-contract assertions

Closes #21

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.