test: guard workflow OIDC grants and remove unused SBOM permission

[dinakarjs]

A workflow added outside the release path could gain OIDC authority without existing release/parity tests noticing. Extend test_release_artifacts.py to scan every .yml/.yaml workflow and require exactly four approved job grants: ci.yml/test for Codecov (the sole test-job exception), release.yml/publish, docker.yml/build-and-push and scorecard.yml/scorecard.

Reject workflow-wide OIDC, inherited grants, job/workflow write-all, unexpected jobs/files, SBOM reintroduction and removal of an approved allowance. Temporary-copy controls cover each drift mode and accept read-only inheritance. Existing credential-free release validation and publication dependency checks remain intact.

Remove id-token: write from sbom.yml: the pinned anchore/sbom-action uses github-token and this unsigned SBOM job does not need OIDC. Other SBOM permissions are retained as declared.

Approved cA2A port under agentrust-io/.github#54 (comment), following cMCP #754. Separate repository PR, review owner Imran.

Validation on Python 3.12.14: fresh virtual environment installed requirements/dev.txt with --require-hashes and the local editable package without dependencies. Full unit/conformance: 828 passed, 2 skipped; all 23 release-artifact checks passed. Repository Ruff and format checks pass (106 files); mypy passes 47 source files; Bandit and git diff --check pass. Proxy variables were cleared for full tests. No workflow dispatched, registry publication, credential or live settings changes.

Source regression guard only; live environment protections, registry bindings and operator coverage remain separate evidence.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

Hosted validation at 3b39cac is complete: all six Python 3.11–3.13 Linux/Windows test jobs and governance passed. Benchmark was skipped. Workflow lint, CodeQL, contributor and vouch checks passed. The only remaining failed check is the expected maintainer-approval gate. Ready for review under the approved #54 port scope.

[imran-siddique]

Same port as cmcp#754, implementing the .github#54 ruling: four named allowances with ci.yml/test as the only test-job exception, and id-token removed from sbom.yml. Verified locally: 23 of 23 pass; restoring the SBOM grant fails 11, and adding id-token: write to the governance job fails 12.