ci: resolve CodeQL code-scanning alerts in workflows

Clears all 27 open code-scanning alerts. Both classes are in GitHub
Actions workflows; no Fortran or toolchain source is touched.

missing-workflow-permissions (26 alerts, medium)

No workflow declared a `permissions:` block, so every job inherited the
repository-default GITHUB_TOKEN scope. None of the flagged jobs write to
the repo through GITHUB_TOKEN -- the three that do publish use their own
secrets (DOC_PUSH_URL, TAP_REPO_TOKEN, CODECOV_TOKEN) -- so a
workflow-level `contents: read` default is sufficient everywhere.

untrusted-checkout/high (1 alert, high)

claude-code-review.yml runs privileged (pull_request_target and
issue_comment: it holds CLAUDE_CODE_OAUTH_TOKEN plus pull-requests and
issues write) and fetched fork commits into that workspace via
`git fetch origin pull/<n>/head`.

That step was dead code: nothing read FETCH_HEAD, and the pr_head_ref
output was written but never consumed. The review already sources its
diff and per-file context through gh API calls that treat fork content
as data rather than as checked-out code, so the step and the unused
output are removed instead of sandboxed. No behavior change.

Claude-Session: https://claude.ai/code/session_01XPqfEaUBG7ZaZVzeMWnKHd

Author: sbryngelson

.github/workflows/bench.yml

@@ -10,6 +10,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}${{ github.event_name == 'pull_request_review' && format('-review-{0}', github.run_id) || '' }}
   cancel-in-progress: true
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes

.github/workflows/claude-code-review.yml

@@ -58,26 +58,17 @@ jobs:
             exit 1
           fi
 
-          PR_HEAD_REF="$(gh pr view "$PR_NUMBER" --repo "${{ github.repository }}" --json headRefName --jq .headRefName)"
-
           echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
-          echo "pr_head_ref=$PR_HEAD_REF" >> "$GITHUB_OUTPUT"
 
+      # Base repo only. This job is privileged (pull_request_target / issue_comment:
+      # it holds secrets and a write-capable token), so the PR head is never checked
+      # out or fetched here. The diff and per-file context are pulled through the gh
+      # API in later steps and treated purely as data.
       - name: Checkout base repo
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
-      - name: Fetch PR head
-        shell: bash
-        env:
-          PR_NUMBER: ${{ steps.mode.outputs.pr_number }}
-        run: |
-          set -euo pipefail
-          # Fetch the PR merge ref — works for both same-repo and fork PRs
-          # (fork branches don't exist on origin, but pull/<n>/head always does)
-          git fetch origin "pull/${PR_NUMBER}/head"
-
       - name: Resolve review state
         id: state
         shell: bash

.github/workflows/cleanliness.yml

@@ -10,6 +10,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes

.github/workflows/convergence.yml

@@ -10,6 +10,10 @@ on:
 env:
   OMPI_MCA_rmaps_base_oversubscribe: 1
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes

.github/workflows/coverage-health.yml

@@ -4,6 +4,10 @@ on:
   schedule:
     - cron: '0 7 * * *'      # daily; loud if the refresh stopped working
   workflow_dispatch:
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   health:
     if: github.repository == 'MFlowCode/MFC'

.github/workflows/coverage.yml

@@ -11,6 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes

.github/workflows/docs.yml

@@ -8,6 +8,10 @@ on:
     branches: [master]
   pull_request:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build & Verify

.github/workflows/formatting.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   docs:
     name:    Formatting

.github/workflows/fp-stability.yml

@@ -35,6 +35,10 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   file-changes:
     name: Detect File Changes

.github/workflows/homebrew-release.yml

@@ -21,6 +21,10 @@ on:
         type: boolean
         default: false
 
+# Least-privilege default: no job in this workflow writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   update-homebrew-tap:
     name: Update homebrew-mfc tap