Fix docs deploy reusable workflow permissions

[Mpdreamz]

Summary

• Remove the packages: read permission from the reusable docs deploy build job.
• Restore compatibility with caller workflows that grant only the permissions actually needed by deploy, like elastic/kibana.

Why

Kibana docs-deploy started failing at GitHub Actions startup after elastic/docs-actions@v1 moved from c38b028 to 70803e3. The first failing run resolved the reusable workflow at 70803e3; the previous successful run resolved c38b028.

The relevant change came from #159 / dd305cc, which added packages: read to .github/workflows/docs-deploy.yml. Kibana's caller workflow does not grant packages, so GitHub rejects the reusable workflow before creating jobs or logs.

Why this started now

#159 has an old PR number because it was opened on 2026-05-16, but it was not merged until 2026-07-29T01:06:47Z. It was first included in a published release when 1.38.1 went out at 2026-07-29T10:29:13Z.

The release history is linear by git ancestry, even though the PR numbers in the release notes are not chronological. The commits between 1.38.0 and 1.38.1 were:

• 9f79596 changelog: Document implicit PR_BODY env consumption #225
• fea018b Add Slack failure alert to create-major-tag workflow #252
• dd305cc security: harden docs-builder, changelog, and workflow trust boundaries #159
• 70803e3 slack/notify-status: include workflow run attempt in status notifications #254

The create-major-tag workflow updates the floating v1 tag when a release is published. Kibana's last successful docs-deploy run resolved @v1 to c38b028 (1.38.0) at 2026-07-29T10:27:35Z. The first startup failure resolved @v1 to 70803e3 (1.38.1) at 2026-07-29T10:30:23Z.

Validation

• git diff --check
• actionlint v1.7.12 .github/workflows/docs-deploy.yml