ci: add explicit permissions to pull_request_target workflows

Add least-privilege permissions blocks to three workflows that use
pull_request_target without explicit permission scoping:

- sync_renovate-changesets: contents:write + pull-requests:write
- sync_dependabot-changesets: contents:write + pull-requests:write
- sync_pull-requests-trigger: all none (only uploads artifacts)

These workflows run in the base repo context and have access to secrets.
Explicit permissions ensure the GITHUB_TOKEN is scoped to only what each
workflow needs, reducing blast radius if a guard is ever bypassed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>

.github/workflows/sync_dependabot-changesets.yml

@@ -5,6 +5,10 @@ on:
       - '.github/workflows/sync_dependabot-changesets.yml'
       - '**/yarn.lock'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   generate-changeset:
     runs-on: ubuntu-latest

.github/workflows/sync_pull-requests-trigger.yml

@@ -16,6 +16,11 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  actions: none
+  contents: none
+  pull-requests: none
+
 jobs:
   trigger:
     if: >

.github/workflows/sync_renovate-changesets.yml

@@ -5,6 +5,10 @@ on:
       - '.github/workflows/sync_renovate-changesets.yml'
       - '**/yarn.lock'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   generate-changeset:
     runs-on: ubuntu-latest