fix(ci): permissions model — no top-level perms in ci.yml; callers need write

GitHub Actions permission model for reusable workflows: callers must declare
at least the permission level that any job in the called workflow requests.
Since the phpcs job declares 'permissions: contents: write' (for phpcbf
commit-back), all callers must include 'permissions: contents: write' at
their workflow level.

Changes:
- ci.yml: remove top-level permissions block (was: contents: read); phpcs job
  already has job-level contents: write. Docblock now explains the caller
  requirement clearly.
- ci-self-test.yml: add 'permissions: contents: write' at workflow level.
- README.md: adoption snippet now includes the required permissions block.
- Remove diagnostic bisect/minimal test workflows (used to identify the root
  cause of startup_failure; finding: job-level write in reusable workflow
  requires caller to declare write at workflow level).

Confirmed: ci-bisect-caller with permissions: contents: write = SUCCESS.
Confirmed: actionlint 1.7.4 + yamllint 1.38.0 both clean.

Agent-Session: claude/reusable-ci-20260616

.github/workflows/ci.yml

@@ -50,9 +50,11 @@
 #         and concatenated verbatim — missing slash produces wrong path).
 #   - Every repo calls `composer test` regardless of the `tests` input; the
 #     input only controls environment provisioning, not the command.
-#   - permissions: contents: read at workflow level; the phpcs job sets
-#     contents: write for phpcbf commit-back only. Calling workflows do NOT
-#     need to declare contents: write — job-level override is sufficient.
+#   - permissions: the phpcs job declares `contents: write` at job level for
+#     phpcbf commit-back. GitHub requires the CALLING WORKFLOW to also declare
+#     `permissions: contents: write` at the caller's workflow level — GH enforces
+#     that callers cannot be escalated beyond their declared scope, even by job-level
+#     overrides in the reusable workflow. All caller repos must include this.
 ##
 
 name: CI — Reusable
@@ -100,9 +102,6 @@ on:
         default: true
         type: boolean
 
-permissions:
-  contents: read  # jobs that need write declare it explicitly (phpcs)
-
 jobs:
 
   # ---------------------------------------------------------------------------