docs: offer a read-only fine-grained token in the CLI walkthrough

The token prompt only described the classic `repo` path, which is
read+write. Add the read-only fine-grained alternative (Contents,
Pull requests, Administration, Dependabot alerts) to both the gh and
PAT instructions, and note that the CLI only ever reads.

Author: blimmer

src/interactive/tokenWalkthrough.test.ts

@@ -43,6 +43,9 @@ describe('interactiveResolveToken', () => {
     expect(note?.message).toContain('gh auth login --scopes');
     expect(note?.message).toContain('repo,read:org,security_events');
     expect(note?.message).not.toContain('github.com/settings/tokens');
+    // also offers the read-only fine-grained alternative
+    expect(note?.message).toContain('fine-grained');
+    expect(note?.message).toContain('Dependabot alerts');
   });
 
   test('shows PAT instructions matching the GitHub UI when gh is not installed', async () => {
@@ -64,6 +67,9 @@ describe('interactiveResolveToken', () => {
     expect(note?.message).toContain('[x] read:org');
     expect(note?.message).toContain('Generate token');
     expect(note?.message).toContain('export GITHUB_TOKEN=ghp_');
+    // also offers the read-only fine-grained alternative
+    expect(note?.message).toContain('settings/personal-access-tokens/new');
+    expect(note?.message).toContain('Dependabot alerts');
   });
 
   test('user declines the retry prompt: returns cancelled', async () => {

src/interactive/tokenWalkthrough.ts

@@ -61,19 +61,23 @@ function defaultHasGhCli(): boolean {
 
 function ghInstructions(): string {
   return [
-    "We need a GitHub token to read your org's Dependabot data.",
+    "We need a GitHub token to read your org's Dependabot data. The CLI only reads; it never writes.",
     '',
     'I see the gh CLI installed. In another terminal, run:',
     '',
     '    gh auth login --scopes "repo,read:org,security_events"',
     '',
     'Pick GitHub.com → HTTPS → "Login with a web browser" and follow the prompts.',
+    '',
+    'Want least privilege? A read-only fine-grained token works too. Grant these',
+    'repository permissions, all Read-only: Contents, Pull requests, Administration,',
+    'and Dependabot alerts, then export GITHUB_TOKEN.',
   ].join('\n');
 }
 
 function patInstructions(): string {
   return [
-    "We need a GitHub token to read your org's Dependabot data.",
+    "We need a GitHub token to read your org's Dependabot data. The CLI only reads; it never writes.",
     '',
     '1. Open https://github.com/settings/tokens/new',
     "   (You'll be asked to confirm your password.)",
@@ -97,6 +101,11 @@ function patInstructions(): string {
     '   Copy it, then in this terminal run:',
     '',
     '       export GITHUB_TOKEN=ghp_...',
+    '',
+    'Prefer least privilege? A read-only fine-grained token works too, at',
+    'https://github.com/settings/personal-access-tokens/new — grant these repository',
+    'permissions, all Read-only: Contents, Pull requests, Administration, and',
+    'Dependabot alerts. Your org must allow fine-grained tokens.',
   ].join('\n');
 }