Change repo-assist to delegate to task-specific workflows with fewer permissions

Currently repo-assist is one generic workflow which combines multiple permissions

We want to change this to be a workflow that delegates to specific task workflows which may have reduced, different safe outputs and permissions

Start by locating the current repo-assist workflow and reviewing how it combines permissions and outputs. Define the task-specific workflows and delegation boundaries; done means each task uses only its required permissions and has the intended safe outputs.

Written by the indexing model from the issue text.