workflows/vendor-gems: stop PR auto-pushes.

[MikeMcQuaid]

• keep pull_request runs read-only so vendored gem updates do not rely on commit credentials in an untrusted context
• keep the out-of-sync failure so maintainers can rerun with workflow_dispatch when a signed bot commit is needed

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR. Please specify below how you used AI to help you, and what steps you have taken to manually verify the changes. Non-maintainers may only have one AI-assisted/generated PR open at a time.

Used OpenAI Codex with manual review.

---

[Copilot]

Pull request overview

This PR updates the vendor-gems GitHub Actions workflow so that pull_request executions remain read-only and never attempt to commit/push changes back to the PR branch. Pushing updates is limited to explicit workflow_dispatch runs, using an app token, keeping untrusted PR contexts free of commit credentials.

Changes:

• Reduce workflow token permissions from contents: write to contents: read.
• Remove the Dependabot-specific auto-checkout/commit/push behavior on pull_request; those steps now run only on workflow_dispatch.
• Require the GitHub App token for the push step (no fallback to secrets.GITHUB_TOKEN).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.