Add explicit permissions to 7 workflows

.github/workflows/daily-news.md

@@ -5,6 +5,8 @@ on:
     - cron: "0 9 * * 1-5"
   workflow_dispatch:
 
+permissions: read-all
+
 engine: copilot
 
 network:

.github/workflows/notion-issue-summary.md

@@ -6,6 +6,10 @@ on:
         description: "Issue number to analyze"
         required: true
         type: string
+permissions:
+  contents: read
+  issues: read
+  actions: read
 tools:
   github:
 imports:

.github/workflows/smoke-claude.md

@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "0 0,6,12,18 * * *"  # Every 6 hours
   workflow_dispatch:
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
 name: Smoke Claude
 engine: claude
 tools:

.github/workflows/smoke-codex.md

@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "0 0,6,12,18 * * *"  # Every 6 hours
   workflow_dispatch:
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
 name: Smoke Codex
 engine: codex
 tools:

.github/workflows/smoke-copilot.firewall.md

@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "0 0,6,12,18 * * *"  # Every 6 hours
   workflow_dispatch:
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
 name: Smoke Copilot Firewall
 engine: copilot
 network:

.github/workflows/smoke-copilot.md

@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "0 0,6,12,18 * * *"  # Every 6 hours
   workflow_dispatch:
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
 name: Smoke Copilot
 engine: copilot
 network:

.github/workflows/smoke-opencode.md

@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "0 0,6,12,18 * * *"  # Every 6 hours
   workflow_dispatch:
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
 name: Smoke OpenCode
 imports:
   - shared/opencode.md