Scope fixture workflow permissions to their calling jobs #552

Context and request

The fixture workflows give every job Pages and OIDC write permissions, including the read-only generated-index verification jobs. Zizmor 1.25.2 reports four existing excessive-permissions findings: pages: write and id-token: write at workflow scope in both .github/workflows/Workflow-Test-Default.yml and .github/workflows/Workflow-Test-WithManifest.yml.

The findings are present unchanged in default-branch source 64ffb1d87f86bd5d487891fdb140b78385a00531 and in the test-alignment head reviewed for #550 and #551. Permission changes are explicitly outside that cleanup's authorization, so no permission or security gate is changed there.

Acceptance criteria

• Both fixture workflows use a default-deny workflow permission floor and explicit job scopes.
• Each reusable-workflow calling job retains exactly the permissions its existing called workflow requires; required build/test/site behavior is not disabled to satisfy lint.
• Each generated-index verification job has only the repository-read access required by checkout/artifact inspection.
• Zizmor no longer reports the four scoped findings, with no new suppression, broad token, disabled check, or expanded access.
• Existing fixture tests, generated-index checks, and reusable-workflow permission validation pass.

Technical decisions

Follow GitHub Actions least-privilege guidance. Preserve the effective permission contract for WorkflowTestDefault and WorkflowTestWithManifest when moving the existing scopes from workflow level to those calling jobs. Give VerifyRootFunctionsIndexDefault and VerifyRootFunctionsIndexWithManifest their own read-only scope. Check the actual called workflow.yml contract before editing; do not infer that a fixture's publish skip setting removes GitHub's static caller/callee permission requirements.

This is one focused permission-scoping PR. It does not change branch protection, release labels, source/test coverage, publication authority, or external identities.

Implementation plan

• Reproduce the four findings with zizmor --offline against the two fixture workflow files and inspect the actual called workflow permission contract.
• Scope the existing permissions to the calling jobs and add the read-only scopes required by the index verification jobs, without changing their behavior.
• Run actionlint, YAML lint, and Zizmor; confirm no suppression or validation-control reduction.
• Run both ordinary fixture workflow paths and verify the build/test/index outcomes before review.