fix(ci): Publish features with the workflow token

[leocavalcante]

Summary

• Feature publish on main fails with GHCR 401 because .github/workflows/features.yml passes secrets.GH_TOKEN. That token is rejected as unauthenticated.
• The job now uses secrets.GITHUB_TOKEN and grants packages: write, contents: write, and pull-requests: write, which devcontainers/action requires to publish.
• This does not change the install-php-extensions feature.

Test plan

• PyYAML loaded .github/workflows/features.yml and checked the token and permissions
• bash tests/install-php-extensions.sh
• shellcheck -x on features/install-php-extensions/install.sh and tests/install-php-extensions.sh
• The CI workflow on this pull request is green
• After merge, the Features workflow on main publishes to ghcr.io without a 401. That job only runs on push to main, so this pull request cannot rerun it