[TrapsterDK]

Refs #2182 (slice A). Slice B (starter callers, dx init template, docs) is #3779 and waits for the starter pin to move past this PR.

Changes

• reusable-consumer.yml: drop checks: write from lint/typecheck/format/generate/security-audit/license-audit/test/build/coverage/dx-ci, and pull-requests: write from dx-ci. Coverage keeps pull-requests: write for its comment. Permission lines only (ci: coverage PR comment keeps a stale PASS when coverage fails #2179 edits coverage steps).
• ci.yml: top-level permissions: contents: read; dogfood no longer grants checks: write.
• ghcr.yml: split into a read-only build job (runs on PRs) and a push job (needs: build, if: workflow_dispatch && inputs.approve) that holds packages/id-token/attestations/artifact-metadata write. Cosign pin readers, the single actions/attest@, and summary strings are byte-identical.
• bump.yml: widen-one is contents: read; the App token does every write.
• New //tools/ci:workflow_permissions_test (yaml_serde, workflow list from workflow_exports): every workflow sets top-level permissions as a map, and every write scope (own or inherited) needs a step that uses it, per a marker table. Unknown write scopes fail. Inline fixtures cover unused checks, inherited unused pull-requests and an unknown scope.
• docs_parity_tests.rs: ./ callers must not grant a scope above what the called workflow requests.
• advisory_snapshots_test.rs: security-audit now expects contents: read only.
• tools/ci/starter_pin.sha256: regenerated. The reusable-docs line was already stale on main (ci: share one repository cache per platform with one pruned saver (#2810) #3758 changed the file after Pin starters to a commit with the documented inputs (#2177) #3765), so workflow_pins_test failed on main too.

Tests

• The guard works: run against main's workflows, it flagged 10 checks: write, dx-ci pull-requests: write, the 2 bump scopes and ci.yml's missing top-level permissions. It passes after the changes.
• tools/dx test passed for workflow_permissions, workflow_pins, actionlint, signing_pins, bazelisk_pins, action_pins, advisory_snapshots, aggregate_gates, bump_auth and release_assets.
• dx_cli_test calling_jobs_grant_every_scope_the_called_workflow_requests passes.
• tools/dx fix --affected made no changes. tools/dx check --affected passes.
• Not verified locally: the dogfood and docs jobs need a green CI run.

🤖 Generated with Claude Code

https://claude.ai/code/session_011u9TXHDZrfmzFQ2WT8QAKK