[aj1126]

Summary

Fixes #22. Part of #12 (item 1 only).

• create permissions for workflows #22 / CodeQL alerts Enhance ingestion engine, update dependencies, and improve documentation #3, feat(delivery): implement markdown export functionality #5: both event workflows ran with no permissions: block. Each now has a workflow-level block, matching docs.yml and test.yml:
  • issue-triage.yml: permissions: issues: write (it reads milestones and sets one on the new issue; with the repo's read-only default token, that step couldn't set a milestone).
  • pr-opened.yml: permissions: {} (its only step authenticates with PROJECT_PAT; GITHUB_TOKEN needs no scopes).
• [TASK]: Chore: Streamline documentation workflow and automate architecture updates #12, item 1: docs/SPRINT_01..04.md move unchanged (100% renames) to docs/archive/sprints/, with a 3-line README there. No other tracked file links to them; the dated 2026-07-17 .agents/stale_docs_report.md still names the old paths and is left as written. Items 2-3 of [TASK]: Chore: Streamline documentation workflow and automate architecture updates #12 (architecture.md generator, husky hook) aren't in this PR.

Spec: aj1126/workstation-handoff specs/SPEC-D3-fa-uap-hygiene.md R4-R5 (built as NX-600, reviewed by execution as NX-601).

Checks run on head 8e4389b8 (on main 8b14e14e), 2026-10-28:

• Workflows parse (js-yaml). Permissions: base issue-triage.yml unset → {"issues":"write"}; base pr-opened.yml unset → {}.
• git diff -M --name-status: 4 × R100.
• npm ci exit 0; npm test → tests 44, pass 44, fail 0 (base: 44 / 44).
• gitleaks git --log-opts=origin/main..HEAD (8.30.1): 0 findings. Control: a planted ghp_ token in a scratch repo was caught.
• Commit signed (G) and signed off. git merge-tree --write-tree origin/main HEAD: clean.

Checklist

• I reviewed whether this change affects README, architecture docs, or legacy docs. Only the sprint notes move; git grep SPRINT_0 finds no links outside the dated stale-docs report.
• If commands, supported file types, or layout metadata changed, I ran npm run docs:generate. Not applicable: none changed, so the generator wasn't run (the check below confirms the generated sections are current).
• I ran npm run docs:check, as its two commands (generate-docs.js --check, validate-docs.js) on an LF git archive export of HEAD, the way Linux CI sees it (the Windows CRLF work tree always reads "stale"): "Autogenerated documentation sections are current." exit 0; "Documentation references and structure are valid." exit 0.
• If historical Python prototype guidance changed, I updated docs/legacy-prototype.md. Not applicable: no prototype guidance changed.