Declare the Default Workflow Token Permission in the Repository Settings Payload #1783

repo-config/settings.json does not declare the repository's default workflow token permission (default_workflow_permissions in the Actions permissions API). So repo-config/configure.sh check neither reads nor asserts it, and a repository keeps whatever value it was created with.

The value differs across the fleet. Read from the API on 2026-09-24:

The difference matters wherever a caller omits a workflow-level permissions: block. The hub's reference stubs (catalog/snippets/workflows/test-pull-request.yml, catalog/snippets/workflows/publish-release.yml) declare permissions: {}, but no D-guarantee or spec check requires it. A stub that drops that block inherits write in some repositories and read in others, and no check notices either way. ptr727/HomeAutomation-Config#437 is one such case.

Two possible fixes:

1. Declare the setting in repo-config/settings.json, presumably read with pull request approval off, so configure.sh check reports drift and apply converges it.
2. Make the workflow-level permissions: {} block a named audit check on the entry-point callers.

Found by the HomeAutomation-Config re-audit (#1781, escalation 1). Run stamp audit run 2026-09-24T20:41:24Z | hub 2c5802f.