Remove issues:write permission, use safe-outputs for write operations

- Changed smoke-detector permissions from issues:write to issues:read
- Safe-outputs (add-comment, create-issue) handle all write operations
- Updated investigate-on-failure jobs to use read-only permissions
- Maintains security by keeping writes in controlled safe-output jobs

Co-authored-by: pelikhan <[email protected]>

Author: Copilot

.github/workflows/smoke-claude.lock.yml

@@ -27,7 +27,6 @@ jobs:
     uses: ./.github/workflows/smoke-detector.lock.yml
     permissions:
       contents: read
-      issues: write
       pull-requests: read
       actions: read
     with:

.github/workflows/smoke-claude.md

@@ -26,7 +26,6 @@ jobs:
     uses: ./.github/workflows/smoke-detector.lock.yml
     permissions:
       contents: read
-      issues: write
       pull-requests: read
       actions: read
     with:

.github/workflows/smoke-codex.lock.yml

@@ -30,7 +30,6 @@ jobs:
     uses: ./.github/workflows/smoke-detector.lock.yml
     permissions:
       contents: read
-      issues: write
       pull-requests: read
       actions: read
     with:

.github/workflows/smoke-codex.md

@@ -29,7 +29,7 @@ on:
         type: string
 permissions:
   contents: read
-  issues: write
+  issues: read
   pull-requests: read
   actions: read
 safe-outputs: