ci: declare least-privilege GITHUB_TOKEN permissions (re-anchors the salvageable delta of #71)

[arena-ai-coding-agent]

Summary

Re-anchors the one genuinely missing piece of PR #71 onto main, and documents why everything else in that PR is already here in newer form.

Why PR #71 cannot merge (measured, 2026-09-26)

1. Wrong lineage → mergeable: CONFLICTING (DIRTY). The PR branch is built on the upstream parent's history (JoshuaJewell:main = ecefb1c is an ancestor; the PR = upstream + 3 commits). main here shares only the initial commit 7884553 with it — the exact fork↔upstream divergence documented in docs/integration/conflict-map-2026-09-25.md. A test merge surfaces 38 conflicting files (add/add: ci.yml, ui.yml, package.json, MetaManifold.jl, Execution.jl, tests, docs, binary bun.lock).
2. Content is ~99% superseded. Of the PR's 319 changed files, 281 are byte-identical with main already (the migration was re-anchored earlier via 0e61f4f and siblings). Net of main, the PR branch has only +398 lines, and after filtering to lines the PR itself authored that main truly lacks:
   • src/analysis/Execution.jl (124 lines): stub/mock code (“Mock p-value”, “Real implementation would call R…”) — replaced on main by the real statistics layer (feat(analysis): exact descriptive summaries (catalogue item 1) #57–fix(analysis): read R's NA as missing so parametric fits run #66).
   • Schema/doc notes “TSS/CSS/RSS deferred alias” — obsolete: main implemented exact TSS/CSS/RSS offsets in feat(analysis): exact TSS/CSS/RSS offsets, and no silent substitutions #61.
   • CI action pins — older than main's (Dependabot keeps main at checkout v7.0.1 / setup-julia v3.0.2 …).
   • Escape-key dialog handlers — superseded by native <dialog> with showModal() (Two overlay modals have no dialog semantics: role="presentation" stands in for a native <dialog> #32), which supplies Escape/role/focus-trap natively.
   • lint_source.jl undeclared-deps, Justfile bootstrap/setup-full, coupling test — all present on main in deliberately newer forms.
   • The 2 CodeQL alerts (“Workflow does not contain permissions”) — the author already fixed these on their branch (6b481a3, eab8ea0), and that piece is what main was still missing.

Changes

• .github/workflows/ci.yml: top-level permissions: contents: read plus job-level blocks on repo-hygiene and test (cicd-squabbler already declares its own). Mirrors ui.yml, which already has a top-level block, and the fix landed on PR Feat/stipple typed studies UI #71's branch.

Recommendation

Close #71 in favour of this PR (its remaining unique content would regress main); carry any future application changes to JoshuaJewell per the PR template's Base check.

Testing

• npx js-yaml .github/workflows/ci.yml parses; permissions present at workflow level and on all jobs.
• scripts/check-spdx.sh OK (291 files), scripts/check-format.sh OK (339 files), scripts/check-lint.sh advisory (bun not installed in sandbox).

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ed0c5ef6-14f8-4e44-8d00-4b8e4ffa0c7d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}