#30248 Trim unused nightly decide permissions

nightly.yml's decide job only reads repository metadata and emits routing/build outputs, but it requested contents: write, attestations: write, and id-token: write. Remove the unused write grants and lock the job to actions: read plus contents: read.

Follow-up to #30173 and fixes #30235. The independent review receipt identified this exact least-privilege gap: “decide keeps unused id-token: write and attestations: write, and its contents: write is broad.”

The decide script uses read-only refs, tags, release metadata, commit comparison, and commit timestamps. It does not create, update, delete, upload, export credentials, attest artifacts, or request an OIDC token. The placement steps continue to use their existing action and snapshot read paths. No runner routing or workflow behavior changes.

Validation:

• python3 -m unittest tests/test_nightly_trusted_routing.py — 34 passed.
• Added a regression asserting the exact read-only permission map and rejecting write-style REST calls in the decide script.
• git diff --check passes.

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Trims nightly.yml's decide job to read-only permissions (actions: read, contents: read), removing the unused contents: write, attestations: write, and id-token: write grants flagged in #30235. The decide script only reads repository refs, tags, releases, and commit metadata and emits routing outputs; it never creates, updates, deletes, uploads, attests artifacts, or requests an OIDC token. Adds a regression test asserting the exact read-only permission map and rejecting write-style REST calls in the decide script.