ci: audit and minimize privileged issue-policy workflow permissions #490

Goal

Reduce the blast radius of the issue-branch policy workflow, which runs on pull_request_target.

Current evidence

The workflow does not check out or execute pull-request code, which avoids the classic privileged-PR execution pattern. It still grants actions: write and statuses: write so it can dispatch revalidation and publish statuses.

Scope

• Determine whether self-dispatch can be replaced with a reusable workflow, workflow_run, or another lower-privilege design.
• Remove any permission not required by the final implementation.
• Preserve strict validation and quoting of all PR-derived values.
• Add workflow security linting and a regression fixture proving that untrusted PR code is never checked out or executed.

Acceptance criteria

• The workflow has the minimum required token permissions.
• No pull_request_target job checks out or runs PR-provided code.
• Branch-policy behavior and stale-commit repair remain covered by hosted checks.
• The security model is documented for maintainers.

This is a v1.0 hardening item; it can follow the P0 publication controls if needed.