test(#829): upgrade stage workflow permissions to YAML-parsed assertions

[fullsend-ai-coder]

Summary

Upgrade permissions assertions in six stage workflow tests (TestTriageWorkflowContent, TestCodeWorkflowContent, TestReviewWorkflowContent, TestFixWorkflowContent, TestRetroWorkflowContent, TestPrioritizeWorkflowContent) from assert.Contains string matching to YAML-parsed structural checks using yaml.Unmarshal + assert.Equal, matching the pattern established by the shim tests in PR fullsend-ai#5786.

Changes

• Replace assert.Contains(t, s, "actions: write") chains with yaml.Unmarshal into typed structs and assert.Equal on full permission maps for all six stage tests
• Add debounce job least-privilege assertion (permissions: {}) in the retro workflow test
• No new dependencies — yaml.v3 is already imported in the file

Testing

• go test ./internal/scaffold/... passes (98 tests, 0 failures)
• go vet ./internal/scaffold/... passes
• All six upgraded tests use yaml.Unmarshal + assert.Equal for permissions — no remaining assert.Contains for permissions values

Checklist

• PR title follows Conventional Commits (correct type, ! for breaking changes)
• Tests added/updated for new or modified logic

---

Closes #829

Post-script verification

• Branch is not main/master (agent/829-yaml-stage-perms-assertions)
• Secret scan passed (gitleaks — c887fc47c59d8b87b5282ca44044d2933d30df41..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:43 AM UTC · Completed 9:55 AM UTC
Commit: 2358c90 · View workflow run →

[fullsend-ai-review]

Looks good to me

[guyoron1]

/fs-fix

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 10:32 AM UTC · Completed 10:37 AM UTC
Commit: 2358c90 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

No code changes needed. The review agent approved the PR. Both CI failures are pre-existing issues unrelated to this PR: (1) pinact SHA-pin error in .github/workflows/fullsend.yaml (protected path), and (2) GCP WIF credential injection failure (infrastructure). The PR's test changes are correct — all 6 upgraded tests pass locally.

Disagreed (2):

1. CI test job failure (make lint-all → pinact error on .github/workflows/fullsend.yaml:52): The pinact error ('action can't be pinned') is on .github/workflows/fullsend.yaml which uses @main instead of a SHA pin. This is a pre-existing issue in a protected path (.github/) unrelated to this PR's changes. The PR only modifies internal/scaffold/scaffold_test.go. The fix agent must not modify protected .github/ files.
2. CI e2e job failure (GCP WIF auth credential injection): The e2e failure is an infrastructure issue: google-github-actions/auth failed because the GCP workload identity provider secret is not injected (likely a fork/secrets-access issue). This is unrelated to the PR's code changes.

Tests: passed

Decision points

• No code changes made because both CI failures are pre-existing infrastructure issues in protected paths, unrelated to the PR's test file changes (alternatives: Fix pinact error in .github/workflows/fullsend.yaml; rationale: .github/ is a protected path that the fix agent must not modify. The PR's actual code changes (YAML-parsed permission assertions) are correct — all 6 tests pass, go vet is clean, gofmt reports no issues.)

---

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[github-actions]

This pull request has been automatically marked as stale because it has not had any activity in the last month. It will be closed in 2 weeks if no further activity occurs. Remove the stale label to reset the inactivity timer.