Fix TokenPermissionsID: apply least-privilege permissions

[hyperpolymath]

Apply principle of least privilege for GITHUB_TOKEN:

• Change top-level permissions to read-only
• Jobs inherit read permissions, can escalate as needed

This resolves Scorecard TokenPermissionsID alerts.

Generated by Mistral Vibe.

Summary

Changes

RSR Quality Checklist

Required

• Tests pass (just test or equivalent)
• Code is formatted (just fmt or equivalent)
• Linter is clean (no new warnings or errors)
• No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
• No unsafe blocks without // SAFETY: comments
• No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

As Applicable

• .machine_readable/STATE.a2ml updated (if project state changed)
• .machine_readable/ECOSYSTEM.a2ml updated (if integrations changed)
• .machine_readable/META.a2ml updated (if architectural decisions changed)
• Documentation updated for user-facing changes
• TOPOLOGY.md updated (if architecture changed)
• CHANGELOG or release notes updated
• New dependencies reviewed for license compatibility (MPL-2.0 / MPL-2.0)
• ABI/FFI changes validated (src/interface/abi/ and src/interface/ffi/ consistent)

Testing

Screenshots

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 10363f1f-5a0e-483e-a9e4-035d7f69f10d

📥 Commits

Reviewing files that changed from the base of the PR and between 53486e6 and 15895c8.

📒 Files selected for processing (1)

• .github/workflows/rhodibot.yml

---

📝 Summary

Summary by CodeRabbit

• Security
  • Reduced the automated workflow’s repository content permissions from write access to read-only access.
  • Existing automated repository updates and pull-request creation behaviour remains unchanged.

Walkthrough

The workflow changes its contents permission from write to read. Its automated repository modification and pull-request logic is unchanged.

Changes

Workflow permissions

Layer / File(s)	Summary
Restrict workflow contents access .github/workflows/rhodibot.yml	The workflow now grants read access for repository contents instead of write access. Existing automation remains unchanged.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow gate
Read-only paws now guard its state
The fix steps stay in line
While write rights decline
A safer burrow awaits ─ small and great}

_{Comment @coderabbitai help to get the list of available commands.}