fix(ci): keep the contents-write token out of the plugin-version bump job's PR-code steps #7697

Problem

.github/workflows/pr-bump-plugin-version.yml (job bump-plugin-version, about :42-56) holds contents: write, checks out the pull request, and then runs a local action (./.github/actions/download-full-history). A local action is loaded from the checked-out pull request, so a pull request from a same-repo branch decides what that step runs while the job's token can write repository contents. The job is gated to Dependabot-authored pull requests (:44), but anyone with push access who pushes to such a branch triggers it.

This is the same class as the one #7696 fixes for statuses: write in pr-require-checks.yml: no job that runs pull-request-controlled code may hold a write scope.

Fix

Run any local action from the default branch's copy (check out the base into a separate path and uses: from there), or split the write step into a job that runs no pull-request code and passes it the computed values.

Acceptance

• No job in pr-bump-plugin-version.yml that runs pull-request-controlled code (a local action or a script from the pull request checkout) holds contents: write.
• The Dependabot bump still lands on the pull request branch.

Refs: #7696, epic #7555

🤖 Generated with Claude Code