## Summary
Hardens GitHub Actions workflow token permissions to address OpenSSF
Scorecard findings.
## Changes
- Default affected workflows to no token permissions (`permissions:
{}`).
- Move required write permissions directly to the jobs that consume
them.
- Document the least-privilege permissions rule in `AGENTS.md`: never
grant write permissions at the workflow top level; scope grants to
`jobs.<id>.permissions`.
## Validation
- `make lint-light` passed locally via pre-commit hooks.
> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻
Atif Ali
671173b498