chore: harden dprint config and CI permissions

[codepuncher]

Two small, independent hardening changes (one commit each).

Exclude submodules and build dirs from dprint

dprint.json's includes: ["README.md"] glob matches every README.md in the tree, so a bare dprint fmt recurses into the lib/ submodules (commonlibsse-ng, vcpkg, skse-mcp) and reformats their READMEs, dirtying the working trees. The CI dprint check and the pre-commit hook are unaffected because they pass explicit paths — but a local dprint fmt hits it. Adds excludes: [lib/**, build/**, vcpkg_installed/**].

Drop unused actions: write permission

The test, build, and clang-tidy jobs in ci.yml only use actions/cache and upload-artifact, neither of which needs the actions scope. Removed for least privilege. (release.yml already omits it.)

Verification

• Bare dprint fmt now touches nothing; submodules stay clean; dprint check still passes on the repo's own docs.
• ci.yml still parses as valid YAML.

[Copilot]

Pull request overview

Hardens local formatting and GitHub Actions permissions by preventing dprint fmt from touching vendored/submodule trees and tightening CI job token scopes.

Changes:

• Add excludes patterns to dprint.json to avoid formatting files in lib/, build/, and vcpkg_installed/.
• Remove actions: write from the test, build, and clang-tidy jobs’ permissions blocks in ci.yml.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
dprint.json	Adds exclude globs so repo-local formatting doesn’t recurse into submodules/build outputs.
.github/workflows/ci.yml	Drops unused actions: write job permission to reduce CI token privileges.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.