feat(slide-major-tag): gate the slide on a parsed per-job callee permissions comparison (closes #836)

[dem-extra1]

Closes #836

Replaces the shell prompt CLAUDE.md's tag-slide policy carries under "Green is necessary and not sufficient" with a parsed per-job permissions: comparison that slide-major-tag.yml runs before moving the tag.

• .github/workflows/scripts/audit_callee_permissions.py: for every workflow_call workflow present at both refs, parse each ref's YAML and compare per-job (and workflow-level) permission key sets and values. An added key, read -> write, a block collapsing to write-all, a job gaining a block, or a job losing its block (inheriting the caller's) is a stop. A removed key or narrowed value is fine. An unparsable workflow fails closed; a renamed workflow is reported for a hand check; the summary line reports how many callee jobs were compared.
• run-audit-callee-permissions-tests.py: throwaway git-repo fixtures (a .yaml case included), negative controls, mutation-confirmed.
• slide-major-tag.yml: runs the audit against the current major tag (resolved from the remote) and $GITHUB_SHA, refusing the slide on a widening unless force: true is passed.
• _selftest.yml: runs the suite.
• CLAUDE.md: the grep bullets become a pointer to the instrument.

This PR does not slide the tag.

🤖 Generated with Claude Code

[dem-extra1]

Working on this --- please hold off until I am done. Building the parsed per-job callee permissions: comparison for slide-major-tag.yml on branch feat/audit-callee-permissions-836.

Posted by Claude Code (AI agent) --- not written by a human.