ci: scope pull-requests: read to the file-changes job

Granting pull-requests: read at the workflow level handed it to every job
in these six files, including the multi-hour NVHPC container lanes and the
self-hosted Frontier and Phoenix runs, none of which touch the PR API.

Only file-changes needs it: it is the sole job running dorny/paths-filter,
it finishes in about ten seconds, and it holds no other privilege. Move the
grant there and return the workflow default to contents: read.

Job-level permissions replace the workflow default outright rather than
merging with it, so contents: read is restated alongside pull-requests:
read in the job block; a bare pull-requests: read there would have revoked
contents and broken the job's own checkout.

Claude-Session: https://claude.ai/code/session_01XPqfEaUBG7ZaZVzeMWnKHd

Author: sbryngelson

.github/workflows/bench.yml

@@ -11,18 +11,22 @@ concurrency:
   cancel-in-progress: true
 
 # Least-privilege default: no job in this workflow writes to the repo.
-# pull-requests: read is required by dorny/paths-filter, which reads the PR's
-# changed-file list through the API on pull_request events.
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   file-changes:
     name: Detect File Changes
     if: >
       github.event_name != 'pull_request_review' ||
       github.event.review.user.type != 'Bot'
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/cleanliness.yml

@@ -11,15 +11,19 @@ concurrency:
   cancel-in-progress: true
 
 # Least-privilege default: no job in this workflow writes to the repo.
-# pull-requests: read is required by dorny/paths-filter, which reads the PR's
-# changed-file list through the API on pull_request events.
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs: 
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/convergence.yml

@@ -11,15 +11,19 @@ env:
   OMPI_MCA_rmaps_base_oversubscribe: 1
 
 # Least-privilege default: no job in this workflow writes to the repo.
-# pull-requests: read is required by dorny/paths-filter, which reads the PR's
-# changed-file list through the API on pull_request events.
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/coverage.yml

@@ -12,15 +12,19 @@ concurrency:
   cancel-in-progress: true
 
 # Least-privilege default: no job in this workflow writes to the repo.
-# pull-requests: read is required by dorny/paths-filter, which reads the PR's
-# changed-file list through the API on pull_request events.
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs: 
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/fp-stability.yml

@@ -36,15 +36,19 @@ on:
   workflow_dispatch:
 
 # Least-privilege default: no job in this workflow writes to the repo.
-# pull-requests: read is required by dorny/paths-filter, which reads the PR's
-# changed-file list through the API on pull_request events.
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}

.github/workflows/test.yml

@@ -13,11 +13,8 @@ concurrency:
   cancel-in-progress: ${{ github.event_name != 'push' }}
 
 # Least-privilege default: no job in this workflow writes to the repo.
-# pull-requests: read is required by dorny/paths-filter, which reads the PR's
-# changed-file list through the API on pull_request events.
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   lint-gate:
@@ -57,6 +54,13 @@ jobs:
 
   file-changes:
     name: Detect File Changes
+    # Job-level permissions replace the workflow default outright rather than
+    # merging with it, so contents must be restated here. paths-filter reads the
+    # PR's changed-file list via pulls.listFiles; this is the only job that needs
+    # it, so it is granted here instead of workflow-wide.
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: 'ubuntu-latest'
     outputs:
       checkall: ${{ steps.changes.outputs.checkall }}