intake-triage: give the model a read-only token; move label writes to a model-free job #804

Summary

In intake-triage.yml, the job that runs the model (both the key job and, after #803, the subscription job) holds issues: write. That job passes GH_TOKEN: ${{ github.token }} to the run-claude-cli step so the model can run read-only gh queries. The CLI's subprocess environment scrub leaves GitHub tokens in place, so the model's tool calls hold a token that can write to issues. Today only fixed read-only gh rules are allowed under dontAsk, so this is defense in depth.

Proposal

• Give the model a read-only token: run the model in a job whose GITHUB_TOKEN has issues: read (and contents: read).
• Move the label, comment and Issue Type writes into a downstream job with no model in it. It validates the model job's structured output, received as a job output or a checked artifact, and applies it.

Related

• run-claude-cli: a process a leg detaches outlives the leg's timeout #799, fix(run-claude-cli)!: run the subscription leg as its own job #803