fix(ci): tighten workflow GITHUB_TOKEN to least privilege (Scorecard Token-Permissions)

[seonghobae]

Summary

Remediates the fixable Scorecard Token-Permissions code-scanning alerts on the org .github workflows by applying least privilege: the workflow-level GITHUB_TOKEN is kept read-only and every write scope is declared only on the job that needs it. No functionality is removed — each write grant is preserved at job scope.

Alerts fixed in code

Alert	File	Fix
#43	strix.yml	Moved top-level id-token:write + statuses:write onto the strix scan job (previously it had no explicit block and inherited the broad top-level token). Workflow-level token is now read-only; the publish job keeps its own job-scoped writes.
#42	security-scan.yml	Dropped redundant top-level security-events:write — the osv-scan, trivy-fs, and scorecard jobs each already declare it at job scope.
#41	osv-scanner-pr.yml	Dropped redundant top-level security-events:write — the osv-scan reusable-workflow job already declares it at job scope.
#9	pr-review-merge-scheduler.yml	Added a least-privilege top-level permissions: contents: read default (workflow previously had none, so jobs inherited the broad default token). scan-pr-queue keeps its own job-scoped writes.
#8	pr-review-fix-scheduler.yml	Added a least-privilege top-level permissions: contents: read default. dispatch-review-fixes keeps its own job-scoped writes.

These are hardening changes; they take effect once Scorecard re-analyzes main after merge.

Not changed (recorded as central-config / required-by-design — deliberately not weakened)

• Job-level write grants that are already least-privilege (Scorecard alerts Block OpenCode approval on stale fact evidence #7, 🧪 [testing improvement] iter_json_objects 함수에 대한 단위 테스트 추가 #21, 🧪 fetch_open_prs 페이지네이션 테스트 추가 #20, 🧪 [test] split_repo 테스트 커버리지 보완 및 base branch 충돌 해소 #19, 🛡️ Sentinel: [HIGH] Fix HTML comment breakout in JSON serialization #6, chore: Record lack of UI codebase in palette journal #5, Add OpenCode review merge automation #4): these are the correct pattern (writes scoped to the job) and are required for the review/merge bots to function.
• Pinned-Dependencies on pip install steps (⚡ Bolt: Optimize JSON decoding in normalize script #12, [codex] harden OpenCode agent evidence gate #11, No UX changes required (No UI Codebase) #10): CI tooling installs; dependency pinning is handled at the requirements-file / central level.
• Dangerous-Workflow on opencode-review.yml pull_request_target PR-head checkout (🛡️ Sentinel: Add organization-wide default security policy #2): architectural and already mitigated with persist-credentials: false; required for the trusted-review bot.
• Org/repo-policy Scorecard checks with no associated file — Branch-Protection (Add Palette journal for profile repo #1), Maintained (🛡️ Sentinel: [CRITICAL] Fix Workflow CI Security Bypass / Markdown Injection #13), CI-Tests (🧹 [코드 건강성 개선] 파이썬 스크립트 미사용 모듈 임포트 제거 #26), Code-Review ([codex] Sync OpenCode and Strix review gates #18), SAST (Add low-risk OpenCode model failure fallback #16), Fuzzing (Handle optional Strix workflow in OpenCode gate #15), CII-Best-Practices (Sync OpenCode review failure handling #14): these reflect org/repo settings, not code, and are not fixable by editing a workflow file. Not dismissed (dismissing them would only game the count).

Testing

Full pytest suite: 171 passed. The 3 failing tests (test_noema_review_gate, two test_opencode_agent_contract) are pre-existing on the base branch (stale contract assertions like default: "-1"), unrelated to these permission edits — verified by running them against a clean tree.

🤖 Generated with Claude Code

[seonghobae]

Superseded by #382, which includes this least-privilege token fix plus the Trivy log visibility and CI regression fixes, all in one current branch.