GitHub Actions permission model for reusable workflows: callers must declare
at least the permission level that any job in the called workflow requests.
Since the phpcs job declares 'permissions: contents: write' (for phpcbf
commit-back), all callers must include 'permissions: contents: write' at
their workflow level.
Changes:
- ci.yml: remove top-level permissions block (was: contents: read); phpcs job
already has job-level contents: write. Docblock now explains the caller
requirement clearly.
- ci-self-test.yml: add 'permissions: contents: write' at workflow level.
- README.md: adoption snippet now includes the required permissions block.
- Remove diagnostic bisect/minimal test workflows (used to identify the root
cause of startup_failure; finding: job-level write in reusable workflow
requires caller to declare write at workflow level).
Confirmed: ci-bisect-caller with permissions: contents: write = SUCCESS.
Confirmed: actionlint 1.7.4 + yamllint 1.38.0 both clean.
Agent-Session: claude/reusable-ci-20260616
d0f8c1d65c