Only a trusted release job needs to publish a package. Other jobs should keep read-only repository access. Which two permission decisions meet that requirement? Select 2.

1. Keep a minimal read-only workflow default instead of granting write permissions to every job.
2. Replace all job tokens with one permanent organization-owner PAT.
3. Leave package publishing permissions unspecified and assume the package filename authorizes the upload.
4. Set write-all at workflow level and depend on unused secrets to prevent writes.
5. Grant the release job the package write permission it needs and any required repository read permission.