fix(strix): align scan job status permission with tightened smoke contract

[seonghobae]

Summary

The required Strix check is currently failing on every PR org-wide. PR #438 tightened scripts/ci/strix_required_workflow_smoke.sh to require statuses: read on exactly the strix scan job and to forbid statuses: write anywhere in the workflow — but strix.yml still grants the scan job statuses: write (reintroduced by #428 after #430 had made it read-only). Because the required-workflow smoke test always validates this repo's HEAD as the trusted source, every Strix run since #438 merged (~03:30 UTC) fails with:

FAIL: Strix workflow must scope statuses: read only to the strix scan job; found: none

Timeline evidence from kaefa#65: Strix passed on a commit at 03:24 UTC and failed at 03:33 UTC, with only a workflow-comment change in between — the breakage tracks #438's merge, not any scanned repo's content.

Change

One line plus its comment: the strix job's statuses: write → statuses: read.

This is functionally safe: every post_strix_status caller publishes commit statuses via the exchanged app/secret tokens (target-app-token, pr-review-merge-token, opencode-approve-token) with no GITHUB_TOKEN fallback — matching the workflow's own comment that "GITHUB_TOKEN can read status evidence but must not write it," and restoring the state #430 previously established.

Verification

bash scripts/ci/strix_required_workflow_smoke.sh passes locally against this tree (it fails identically to the org-wide runs against current main).

🤖 Generated with Claude Code

https://claude.ai/code/session_01AMkMUa1c1RRsbHEfsQUhui

---

Generated by Claude Code

[opencode-agent]

OpenCode Review Overview

• Head SHA: 34fcbc51f04e6463189cd6016bd57e52f8ee9611
• Workflow run: 29138349444
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: strix.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: strix.yml"]
  R1 --> V1["actionlint plus required checks"]

Loading

[seonghobae]

Closing as superseded and unsafe to merge.

Current-head evidence:

• The intended Strix change (statuses: write -> statuses: read for the strix job) is already present on current main.
• This PR is DIRTY and branch-vs-main diff now deletes active security governance files: .github/workflows/secret-scan.yml, python-security.yml, sast-semgrep.yml, scheduled-security-scan.yml, .gitleaks.toml, .gitleaksignore, scripts/ci/filter_gitleaks_sarif.py, and their tests/lock files.
• Current checks are stale and failed/cancelled because the branch is behind: OpenCode failed, Strix was cancelled, and mergeStateStatus is DIRTY.

Action: close instead of rebase/merge. Reopening this change would lower central security coverage; the real Strix permission fix is already on main.