[framework-best-practices] Use job-level permissions in remediation trigger workflows

## Framework / Library Best Practices Findings

### 1. Remediation trigger workflows grant write permissions to all jobs instead of using job-level scopes
**Library:** GitHub Actions workflow syntax (repository `GITHUB_TOKEN` permissions)

**Library feature:** Job-level `permissions` to scope token access per job.

**Current code:**
Top-level permissions are broad in all remediation trigger workflows, so both `run` and `create_pr_from_issue` jobs inherit write access:
- `.github/workflows/trigger-code-complexity-detector.yml` (lines 9-14)
- `.github/workflows/trigger-code-duplication-detector.yml` (lines 9-14)
- `.github/workflows/trigger-docs-patrol.yml` (lines 9-14)
- `.github/workflows/trigger-framework-best-practices.yml` (lines 9-14)
- `.github/workflows/trigger-newbie-contributor-patrol.yml` (lines 9-14)
- `.github/workflows/trigger-text-auditor.yml` (lines 9-14)

These workflows currently set:
```yaml
permissions:
contents: write
issues: write
pull-requests: write
actions: read
```
while only the follow-up `create_pr_from_issue` job needs full write scope.

**Simplification:**
Use job-level permissions so each job receives only the scopes it needs:
1. Set restrictive top-level defaults (for example `contents: read`).
2. Add narrower `permissions` on `run` (for detector issue creation flow).
3. Keep broader write permissions only on `create_pr_from_issue`.

This uses a native GitHub Actions capability and removes repeated over-scoping in generated triggers.

**Documentation:**
- https://docs.github.com/actions/using-jobs/assigning-permissions-to-jobs
- https://docs.github.com/actions/security-guides/automatic-token-authentication

## Suggested Actions
- [ ] Update `scripts/dogfood.sh` remediation injection logic to emit job-level `permissions` rather than broad top-level write permissions.
- [ ] Regenerate trigger workflows and verify the six remediation trigger files above use least-privilege job scopes.
- [ ] Ensure detector `run` jobs still have required issue-creation scopes, and `create_pr_from_issue` keeps only the extra write scopes it needs.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Framework Best Practices](https://github.com/elastic/ai-github-actions/actions/runs/23947946533)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.