sec(2157): scope the add-to-kanban App token to least privilege (the source of truth)

[LukasWodka]

Refs backend#2157. The source of truth — byte-identical to the 16 copies already merged, which is the whole point: this file is what caller-drift measures every other repo against.

The ordering is inverted from where this sweep started, deliberately

"Source of truth last" minimises the peak number of drift findings while most repos are unswept. Once the majority has flipped it does the opposite — holding this file back is now the only thing keeping the audit red:

.github's copy	drift findings
unscoped (today)	16 — every merged copy differs from it
scoped (this PR)	1 — only cli remains, its PR still open

So this lands before the last straggler rather than after it. The heuristic was right for the first sixteen PRs and wrong for the seventeenth, and I'd rather say that than quietly follow it off a cliff.

What it changes

permissions: {} # the job needs no GITHUB_TOKENrepositories: ${{ github.event.repository.name }} # reads stop being org-widepermission-issues: readpermission-pull-requests: readpermission-organization-projects: write

Verified live before the sweep started: run 32255581084 exercised these exact scopes and landed the card (Status=Code review), which settles whether repositories: scoping clips organization_projects. It does not.

What is deliberately NOT in this PR

repo-inventory.yml's divergent reason for release-train claims its header "is now the ONLY difference". That is still false in two ways — release-train's copy also lacks the scoping until release-train#93 merges, and it carries a second comment difference (the Dependabot note) the reason never mentions.

Editing it here would make the inventory assert something untrue about a file that hasn't changed yet. It follows #93.

After this merges

Dispatch caller-drift read-only and expect 1 finding (cli), not 0 — and that is the correct answer, not a regression. It reaches 0 when cli#533 lands.

---

Note

^{Cursor Bugbot is generating a summary for commit cbb65fa. Configure here.}

[saadqbal]

/fr-pass

CI-only: scopes the add-to-kanban App token to least privilege. No product surface, so the staging journey neither covers it nor needs to — the repo's own CI is the verification. Advancing as part of the fleet-wide 2157/2166 sweep.