fix(ci): permissions model — no top-level perms in ci.yml; callers need write

GitHub Actions permission model for reusable workflows: callers must declare
at least the permission level that any job in the called workflow requests.
Since the phpcs job declares 'permissions: contents: write' (for phpcbf
commit-back), all callers must include 'permissions: contents: write' at
their workflow level.

Changes:
- ci.yml: remove top-level permissions block (was: contents: read); phpcs job
  already has job-level contents: write. Docblock now explains the caller
  requirement clearly.
- ci-self-test.yml: add 'permissions: contents: write' at workflow level.
- README.md: adoption snippet now includes the required permissions block.
- Remove diagnostic bisect/minimal test workflows (used to identify the root
  cause of startup_failure; finding: job-level write in reusable workflow
  requires caller to declare write at workflow level).

Confirmed: ci-bisect-caller with permissions: contents: write = SUCCESS.
Confirmed: actionlint 1.7.4 + yamllint 1.38.0 both clean.

Agent-Session: claude/reusable-ci-20260616

.github/workflows/ci-self-test.yml

@@ -1,8 +1,9 @@
 # Self-test: exercises the reusable ci.yml on this repo itself.
 # Uses tests: none (peptide-e2e is a Playwright/Node repo, no PHP suite).
-# phpcs_autofix: false avoids needing contents: write at the caller level
-# (the phpcs job in ci.yml has its own job-level write permission for phpcbf).
-# Purpose: smoke-check that the reusable workflow skeleton runs without errors.
+# permissions: contents: write is required at the caller level — any caller of
+# ci.yml must declare this so the phpcs job can commit phpcbf fixes back to the
+# PR branch. Even with phpcs_autofix: false here, the permission must be declared
+# for the reusable workflow to pass GH's startup permission-escalation check.
 
 name: CI Self-Test (reusable ci.yml)
 
@@ -12,6 +13,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: write  # required: called ci.yml phpcs job declares job-level write for phpcbf
+
 jobs:
   ci:
     uses: ./.github/workflows/ci.yml