[version bump] handlebars

[maitxn]

Summary

• Version bump: Updates the handlebars transitive dependency from 4.7.8 to 4.7.9 to resolve a batch of critical security advisories.
• CI fix: Grants deployments: write permission to the test and deploy jobs so the action's delete-all / create steps can manage deployment statuses.

Why the CI fix is needed

The build-test run on this branch failed at the Delete all deployments step with:

HttpError: Resource not accessible by integration (403)
Delete all deployments failed
POST /repos/npm/action-deploy/deployments/:id/statuses

The job's GITHUB_TOKEN was running with the default read-only permission set:

Contents: read
Metadata: read
Packages: read

Invalidating a deployment requires POST .../deployments/:id/statuses, which needs deployments: write. Adding an explicit permissions block restores the required scope. This PR is not cross-repository, so the elevated token permission applies.

Changes

File	Change
.github/workflows/test.yml	Add permissions: deployments: write / contents: read to the test job
.github/workflows/deploy.yml	Add permissions: deployments: write / contents: read to the deploy job
package-lock.json	Bump handlebars 4.7.8 → 4.7.9

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.