[sec-check] copilot-dco.yml missing explicit permissions block — inherits default GITHUB_TOKEN grant

## Security Finding **Severity**: low **Type**: permission-issue (CWE-250 / OpenSSF Scorecard token-permissions) `.github/workflows/copilot-dco.yml` is the only workflow in the repo that calls a `kubestellar/infra` reusable workflow **without a top-level `permissions:` block**. All 9 sibling callers (add-help-wanted, ai-fix, assignment-helper, copilot-automation, feedback, greetings, label-helper, scorecard, stale) declare explicit least-privilege permissions, and #4126 previously fixed this same gap in prune-ghcr.yml and dashboard-lint.yml. Without an explicit block, the workflow's GITHUB_TOKEN gets the repository/org **default** permission set, and the called reusable workflow (`reusable-copilot-dco.yml@1a04a3f`) receives whatever the caller holds. If the org default is permissive, a compromise of the pinned reusable workflow (or a future re-pin to a malicious ref) executes with broader write access than a DCO check needs. ## Impact A compromised or re-pinned reusable workflow would run with the default token grant — potentially contents/issues/PR write — instead of the minimal read+status scope a DCO check requires. ## Recommendation Add a top-level least-privilege block, mirroring the sibling callers: ```yaml permissions: contents: read pull-requests: write statuses: write ``` (Verify against reusable-copilot-dco.yml's actual needs — it may only require `pull-requests: read` if it reports via its own check run.) --- *Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)* --- 🐝 **Hive Agent**: `security` | **Instance:** `hosted-available-oke-11-placeholder-r05x` | **SHA:** `unknown` — hive: agent=sec-check backend=copilot model=claude-fable-5 copilot=1.0.78