ci: add permissions to publish caller job and upgrade release-please-action to v5

[kinyoklion]

Summary

Fixes Release Please startup_failure by adding explicit permissions to the publish caller job. Also upgrades release-please-action from v4 to v5.

Review & Testing Checklist for Human

• Verify the release-please workflow runs without startup_failure on next push to main

Notes

Same fix pattern as dotnet-core PR #241. The publish caller job needs explicit permissions because publish.yml declares permissions that exceed the restricted org defaults.

Link to Devin session: https://app.devin.ai/sessions/54e32482848742c19ebf9c374efdc833
Requested by: @kinyoklion

---

Note

Low Risk
Workflow-only changes; main risk is misconfigured GitHub Actions permissions or action upgrade causing the release/publish pipeline to fail.

Overview
Upgrades googleapis/release-please-action in release-please.yml from v4 to v5.

Adds explicit permissions to the publish caller job (including attestations: write) so it can invoke publish.yml without permission-related startup failures under restricted org defaults.

^{Reviewed by Cursor Bugbot for commit 0ff5510. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring