Reduce workflow permissions to match lock file requirements

[Copilot]

discussions: write and pull-requests: write were added to several workflows as a workaround for a gh-aw compiler issue (github/gh-aw#16673). With the new compiler version these are no longer needed — the regenerated lock files reflect actual requirements.

Changes

Compared every trigger/example file's granted permissions against the union of job-level permissions in the corresponding .lock.yml:

• Removed discussions: write from pr-checks-fix, pr-ci-detective, pr-ci-fixer (trigger + example)
• Downgraded pull-requests: write → read in duplicate-issue-detector, pr-ci-detective, issue-triage, pr-checks-fix, pr-ci-fixer (trigger + example) — comments are posted via COPILOT_GITHUB_TOKEN so only read access is needed for the workflow token
• Removed stale # required by gh-aw compiler for add-comment (github/gh-aw#16673) comments from all files

Kept (verified needed per lock files)

discussions: write and pull-requests: write are retained where lock files actually declare them in job-level permissions and the workflow token genuinely needs write access: issue-triage-pr, mention-in-issue, mention-in-pr.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Reduce permissions in workflows</issue_title>
<issue_description>We had added discussions: write and pull-requests: write based on needing github/gh-aw#16673

but now we dont need them anymore that we're on new compiler version.

let's clean these up</issue_description>

<agent_instructions>Look at the final reply from the agent and implement it, double checking granted perms vs lock files, etc</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@strawgate /ai what about now? ive regenerated the lock files

• Fixes Reduce permissions in workflows #251

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[strawgate]

should be read, no?

[Copilot]

Changed to pull-requests: read in both the example and trigger file in fe1c46f.

[strawgate]

pull-requests: read

as we're just leaving a comment

[Copilot]

Changed to pull-requests: read in both the example and trigger file in fe1c46f.

[strawgate]

should be read as we're just leaving a comment

[Copilot]

Changed to pull-requests: read in both the example and trigger file in fe1c46f.

[strawgate]

@copilot address PR Feedback