fix(ci): drop persisted checkout credentials and pass matrix.tool through env (#658)

* fix(ci): drop persisted checkout credentials and pass matrix.tool through env

All nine actions/checkout steps left the job token in .git/config for
every later step, including bun install and bun test in CLI code a pull
request brings (zizmor artipacked). Each now sets
persist-credentials: false; no step needed the stored credential.

cli-checks expanded ${{ matrix.tool }} - a directory name discover-clis
reads from the PR's tree - into its shell script (zizmor
template-injection). It now arrives through env.

upstream-watch.yml grants issues: write to its one job rather than the
whole workflow.

The new stdlib-only test reproduces zizmor's findings on master exactly
(9 artipacked, 1 template-injection at ci.yml:227) and passes here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* changelog: place the #658 entry under [Unreleased]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>

.github/workflows/upstream-watch.yml

@@ -32,7 +32,6 @@ on:
 
 permissions:
   contents: read
-  issues: write
 
 jobs:
   triage:
@@ -41,10 +40,17 @@ jobs:
     # tests/test_upstream_triage.py so a template clone never runs it by surprise.
     if: github.repository != 'MadsLorentzen/ai-job-search'
     runs-on: ubuntu-latest
+    # Issue write is granted to this one job, not the workflow, so a job added
+    # later starts read-only.
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
+          # The fetch below reads a public remote; nothing here pushes.
+          persist-credentials: false
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"