ci: Fix release upload by passing tag and refining permissions/files

Ensure the CD workflow passes the release tag explicitly to
`softprops/action-gh-release` using `tag_name` fixing the error
"GitHub Releases requires a tag".

Also:
- Define minimal job-level permissions (`contents: write`)
- Refine glob pattern to upload only from `*-packages/`
- Restrict file listing in the debug step to avoid noise

Author: jcfr

.github/workflows/CD.yml

@@ -10,10 +10,15 @@ on:
     types:
       - published
 
+permissions: {} # No permissions are granted at the workflow level
+
 jobs:
   upload-release-assets:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+
     steps:
       - name: Set TAG_NAME
         id: vars
@@ -48,12 +53,13 @@ jobs:
           name_is_regexp: true
 
       - name: List downloaded files
-        run: ls -1 -R
+        run: ls -1 -R *-packages
 
       - name: Upload release assets
         uses: softprops/action-gh-release@v1
         with:
+          tag_name: ${{ steps.vars.outputs.TAG_NAME }}
           files: |
-            **/CTKAppLauncher-*.tar.gz
+            *-packages/CTKAppLauncher-*.tar.gz
         env:
           GITHUB_TOKEN: ${{ secrets.COMMONTKBOT_GITHUB_TOKEN }}