ci: harden GitHub workflow permissions to least privilege (#27414)

## Summary

Hardens GitHub Actions workflow token permissions to address OpenSSF
Scorecard findings.

## Changes

- Default affected workflows to no token permissions (`permissions:
{}`).
- Move required write permissions directly to the jobs that consume
them.
- Document the least-privilege permissions rule in `AGENTS.md`: never
grant write permissions at the workflow top level; scope grants to
`jobs.<id>.permissions`.

## Validation

- `make lint-light` passed locally via pre-commit hooks.

> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻

.github/workflows/cherry-pick.yaml

@@ -22,11 +22,7 @@ on:
       - closed
       - labeled
 
-permissions:
-  contents: write
-  pull-requests: write
-  # Required to create the release-specific cherry-pick label if missing.
-  issues: write
+permissions: {}
 
 # Prevent duplicate runs for the same PR when both 'closed' and 'labeled'
 # fire in quick succession.
@@ -36,6 +32,11 @@ concurrency:
 jobs:
   cherry-pick:
     name: Cherry-pick to latest release
+    permissions:
+      contents: write
+      pull-requests: write
+      # Required to create the release-specific cherry-pick label if missing.
+      issues: write
     if: >
       github.event.pull_request.merged == true &&
       contains(github.event.pull_request.labels.*.name, 'cherry-pick')

.github/workflows/pr-auto-assign.yaml

@@ -7,11 +7,12 @@ on:
   pull_request_target:
     types: [opened]
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   assign-author:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/pr-cherry-pick-check.yaml

@@ -9,11 +9,12 @@ on:
     branches:
       - "release/*"
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   check-cherry-pick:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/publish-mcp-registry.yaml

@@ -15,6 +15,8 @@ on:
         default: false
         type: boolean
 
+permissions: {}
+
 jobs:
   publish-mcp:
     runs-on: ubuntu-latest