fix(ci): harden generated import workflow

[jgpruitt]

Summary

• restore explicit contents: read permission in generated CI workflows
• prevent actions/checkout from persisting its GitHub token after checkout
• add workflow-rendering regression coverage

Validation

• ./bun test packages/cli/commands/project-ci.test.ts
• ./bun run check

Fixes TNT-230.

[Copilot]

Pull request overview

This PR hardens the GitHub Actions workflow generated by me ci install (Memory Engine CLI) to reduce token exposure and to avoid relying on GitHub’s default workflow permissions, and adds regression tests to ensure the rendered workflow stays hardened.

Changes:

• Add an explicit workflow-level permissions: contents: read block to generated import workflows.
• Disable actions/checkout credential persistence via persist-credentials: false.
• Extend workflow-rendering tests to assert both hardening measures, and update the repo’s checked-in me-import.yml accordingly.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
packages/cli/commands/project-ci.ts	Updates the workflow template rendered by me ci install to set explicit permissions and disable checkout credential persistence.
packages/cli/commands/project-ci.test.ts	Adds assertions to lock in the workflow hardening behavior as regression coverage.
.github/workflows/me-import.yml	Applies the newly hardened settings to this repo’s import workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.