fix: address validation feedback

- Add explicit `permissions: contents: read` to info-plist-check.yml
  to satisfy CodeQL actions/missing-workflow-permissions
- Release probe stream on Camera init failure so the camera light
  doesn't stay on after a late error

Agent-Logs-Url: https://github.com/infinilabs/coco-app/sessions/c8e85860-673a-4951-8677-8fcaeb8ad109

Co-authored-by: medcl <64487+medcl@users.noreply.github.com>

.github/workflows/info-plist-check.yml

@@ -13,6 +13,9 @@ on:
       - 'src-tauri/Info.plist'
       - 'scripts/check-info-plist.cjs'
 
+permissions:
+  contents: read
+
 jobs:
   # Quick syntactic / duplicate-key check that runs on every platform.
   source-check:

src/components/Search/Camera.tsx

@@ -233,6 +233,9 @@ const Camera = () => {
         console.error(
           `[Camera] initialization failed: ${classified.name} - ${classified.message}`
         );
+        // Always release any probe stream we may have acquired before
+        // the failure, otherwise the camera light stays on.
+        stopCurrentStream();
         if (!cancelled) {
           setLastError({
             name: classified.name,