Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/reusable-release-auto-on-tag.yml:
- Around line 125-128: The GitHub App token created by
actions/create-github-app-token is not scoped and inherits all installation
permissions; restrict it to least privilege by adding the permissions input and
set contents: write so the token only allows pushing tags. Update the step that
uses actions/create-github-app-token@... (the one with inputs client-id and
private-key) to include a permissions mapping with permission-contents: write
(i.e., the permissions: contents: write equivalent) so the token cannot use
broader installation rights.

---

Outside diff comments:
In @.github/workflows/reusable-sync-team-access.yml:
- Around line 84-90: The workflow currently uses
actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 to mint
a token (see the step that passes repositories: ${{
steps.target.outputs.repo_name }}) but does not set any permission-* inputs, so
the token may inherit overly-broad installation permissions; update that
create-github-app-token step to include explicit minimal permission-* inputs
required by the later repository_dispatch call (identify the repository_dispatch
step that targets ${{ steps.target.outputs.repo_name }} and add only the
corresponding permission-* keys with least privilege), ensuring you reference
the same action usage
(actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1) and
preserve client-id, private-key, repositories, owner inputs.