ci: least-privilege GITHUB_TOKEN in maintenance-lint-scripts-post

Author: iav

.github/workflows/maintenance-lint-scripts-post.yml

@@ -30,15 +30,17 @@ on:
 
 permissions:
   contents: read
-  actions: read    # required by actions/download-artifact@v4 when downloading from another workflow run via `run-id`
-  pull-requests: write
-  checks: write
-  issues: write    # documented requirement of reviewdog for PR-comment APIs
 
 jobs:
   Post:
     name: Post ShellCheck and shfmt diagnostics
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read    # required by actions/download-artifact@v4 when downloading from another workflow run via `run-id`
+      pull-requests: write
+      checks: write
+      issues: write    # documented requirement of reviewdog for PR-comment APIs
     # Run even on red-cross lint conclusions (`failure`) — the
     # artifact is uploaded via `if: always()` in the lint workflow,
     # and we want to surface diagnostics in the PR even when the