fix(github-app): avoid PR write overprivilege

[JSONbored]

Motivation

• The app mistakenly required pull_requests: write for public comment/label and command-preview flows even though those surfaces use GitHub Issues API endpoints, broadening installation token privileges unnecessarily.
• The intent is to restore the least-privilege model while keeping existing public comment/label functionality intact.

Description

• Reverted the required app permission pull_requests from write back to read in REQUIRED_INSTALLATION_PERMISSIONS by updating src/github/backfill.ts to reflect the actual usage.
• Adjusted installation repair diagnostics so comment/label mode impact entries reference issues: write (the Issues API) instead of pull_requests: write.
• Updated command-preview logic in src/api/routes.ts to block public previews only when issues: write is missing and to stop treating pull_requests as a blocking permission for posting comments/labels.
• Updated settings preview messaging in src/signals/settings-preview.ts to instruct operators to restore Issues: write (not Pull requests: write) for public comments/labels and command responses.
• Updated tests that asserted the broader permission model to expect the narrower pull_requests: read + issues: write behavior.

Testing

• Ran npm run typecheck and fixed a typing issue; the TypeScript build completed successfully.
• Ran unit and integration tests with npm test -- --run test/unit/backfill.test.ts test/integration/api.test.ts test/unit/settings-preview.test.ts, and all tests passed.
• Ran git diff --check as a local lint/sanity check; no diff/check errors remained.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	493b443	Commit Preview URL Branch Preview URL	Jun 05 2026, 06:32 PM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#427 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.