net 10 upgrade completed

[StuartFerguson]

closes #1466
closes #1462
closes #1423

General fix:
Explicitly set the permissions key either at the workflow root (affecting all jobs that do not have their own permissions block) or for each job individually. Set the minimal permissions required for the job(s). If unsure of minimal permissions, use contents: read as a securing default, then escalate only as required for specific steps (e.g., pull-requests: write if modifying PRs).

Best specific fix:
Because the flag was highlighted at the deployproduction job (starting at line 111), and to avoid potential impacts on job inheritance, it makes sense to add a permissions: {} block to the deployproduction job, explicitly limiting the token permissions to none unless further privileges are required by steps in this job.

Implementation steps:

• Add permissions: {} as the first property under the deployproduction: job definition (just after line 111).
• No new methods, imports, or variable definitions are required; this is a YAML structure-only change.

---