fix(ci): add contents:read permission and set VOID_PROJECT explicitly

The checkout action needs contents:read when custom permissions are set.
Set VOID_PROJECT to vp-setup-staging explicitly instead of relying on
.void/project.json.

Author: fengmk2

.github/workflows/ci.yml

@@ -6,6 +6,7 @@ on:
     branches: [main]
 
 permissions:
+  contents: read
   pull-requests: write
 
 jobs:
@@ -38,6 +39,7 @@ jobs:
       - run: vpx void deploy
         env:
           VOID_TOKEN: ${{ secrets.VOID_TOKEN }}
+          VOID_PROJECT: vp-setup-staging
       - name: Comment on PR
         uses: actions/github-script@v7
         with: