[plan] Add explicit permissions to 14 workflows with risky trigger events

[github-actions]

Objective

Add explicit permissions: blocks to 14 workflows that use default (write) permissions with risky trigger events like workflow_dispatch or issue_comment.

Context

From discussion #12276, these workflows have medium-priority security issues violating the least-privilege principle. They run on risky triggers with default write permissions when they may only need read access.

Affected Workflows

1. cloclo
2. q
3. plan
4. brave
5. mergefest
6. pdf-summary
7. grumpy-reviewer
8. pr-nitpick-reviewer
9. archie
10. security-review
11. scout
12. ai-moderator
13. tidy
14. unbloat-docs

Solution Templates

For read-only agents (analysis, reports):

---
title: My Analyzer
permissions:
  contents: read
on:
  workflow_dispatch:
---

For comment-only agents (reviewers, moderators):

---
title: My Reviewer
permissions:
  contents: read
  issues: write
  pull-requests: write
on:
  workflow_dispatch:
  issue_comment:
---

For code-modifying agents (auto-fixers, updaters):

---
title: My Auto-fixer
permissions:
  contents: write
  pull-requests: write
on:
  workflow_dispatch:
---

Approach

1. Review each workflow's purpose to determine required permissions
2. Add minimal permissions to workflow frontmatter (.md files)
3. Recompile workflows with make recompile
4. Verify with poutine scan that warnings are resolved

Acceptance Criteria

• All 14 workflows have explicit permissions: blocks
• Permissions follow least-privilege principle
• Workflows function correctly with restricted permissions
• Run make agent-finish before committing

References

• GitHub Security Hardening Guide

AI generated by Plan Command for discussion #12276

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

AI generated by Issue Monster