fix(ci): drop invalid workflows permission scope from branch-cleanup

.github/workflows/AUDIT.md

@@ -12,7 +12,7 @@ concrete reason, verified against the actual repository tree.
 | `auto-assign.yml` | **FIX** | Replaced `gh issue edit` with the REST assignees endpoint. The CLI command used GraphQL `replaceActorsForAssignable`, which fails for this repository's GitHub App token when assigning the issue owner. |
 | `auto-label.yml` | KEEP | Labels PRs by changed file type; guarded with try/catch. |
 | `autonomous-video-processing.yml` | **FIX** | Was a discovery loop whose "processing" step incremented a counter and printed success, so every run reported videos as processed without doing any work. Inline heredoc extracted to `scripts/ci/autonomous_video_{plan,processing,summary}.py` (lintable + unit-tested); added `workflow_call`, secret preflight, guardrail caps, per-video correlation-ID manifests, 30-day evidence retention, and a QA-gated deliverables upload. See the "Multi-agent pipeline alignment" note below. |
-| `branch-cleanup.yml` | **FIX** | Added `workflows: write` permission (missing permission caused push of restored branch to fail with "refusing to allow a GitHub App to create or update workflow ... without `workflows` permission"). Also restored push-sentinel trigger for `claude/branch-cleanup-*` branches and the restore-branch step, and removed the incorrect NOTE claiming restoration of workflow-containing branches is impossible with this token. |
+| `branch-cleanup.yml` | **FIX** | Restored push-sentinel trigger for `claude/branch-cleanup-*` branches and the restore-branch step. **Correction (#1405):** an earlier revision added a `workflows: write` permission to answer "refusing to allow a GitHub App to create or update workflow ... without `workflows` permission". `workflows` is not a GitHub Actions permission scope, so that key granted nothing and made the file unparseable — 1,182 zero-duration failed runs, 100% of them, on every push to every branch including `main`. The key is removed. The NOTE it also deleted was correct: `GITHUB_TOKEN` cannot create or update files under `.github/workflows/`, and no `permissions:` key lifts that, so restoring a branch whose tree contains workflow files needs a PAT with the `workflow` scope or a local push. |
 | `bulk-issue-processor.yml` | KEEP | Manual bulk issue ops via `gh` + Python; dry-run default. |
 | `ci.yml` | **FIX** | Added blocking `apps/web` type-check and ESLint steps before the build so CI fails fast on TypeScript or lint regressions. |
 | `codeql-analysis.yml` | **FIX** | Removed the OWASP `dependency-check` job — pinned to unstable `@main` and pointed at dead paths (`frontend/node_modules`, `src/mcp-bridge.py`); produced no usable SARIF. Switched the Node cache from the dead `frontend/node_modules` path to the npm download cache (`~/.npm`), which is correct for this npm-workspaces repo. CodeQL analysis itself retained. Dependency coverage already lives in `dependency-review.yml` + `security.yml`. |

.github/workflows/branch-cleanup.yml

@@ -2,7 +2,12 @@ name: Branch Cleanup
 
 # Manual, gated branch pruning driven by the branch-cleanup assessment.
 # Runs the archive-then-delete harness server-side, where the GITHUB_TOKEN has
-# the `contents: write` and `workflows: write` rights needed to delete/restore refs.
+# the `contents: write` rights needed to tag and delete refs.
+#
+# NOTE: `workflows` is not a GitHub Actions permission scope and cannot be
+# granted to GITHUB_TOKEN here — see the `permissions:` block below. Restoring a
+# branch whose tree contains `.github/workflows/` files therefore needs a PAT
+# with the `workflow` scope, or a local push.
 #
 # Triggers:
 #   1. workflow_dispatch (from default branch): Actions UI, pick batch + dry_run.
@@ -43,7 +48,6 @@ on:
 permissions:
   contents: write
   pull-requests: read
-  workflows: write
 
 jobs:
   cleanup: