Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Replace overly broad `permissions: read-all` with minimal `contents: read` at workflow level in pr-lint.yml and sync-labels.yml. Job-level permissions already declare specific needs.