fix(ci): harden generated import workflow

.github/workflows/me-import.yml

@@ -1,33 +1,38 @@
-# Managed by 'me ci install' — re-run it to update; remove this line to hand-maintain.
 name: Memory Engine import
 on:
-  push: # all branches — the job itself gates on the default branch
-  workflow_dispatch: {} # manual backfill / re-run
+  push:
+  workflow_dispatch: {}
 
 permissions:
   contents: read
 
 concurrency:
   group: me-import-${{ github.ref }}
-  cancel-in-progress: true # newest run on the same ref supersedes: every run is a full catch-up
+  cancel-in-progress: true
 
 jobs:
   import:
-    # Default branch only, discovered at runtime — survives a rename, and
-    # keeps this file identical across repos (no scaffold-time values).
     if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
-          fetch-depth: 0 # REQUIRED — the git walk and docs git-date temporals need full history
+          fetch-depth: 0
+          persist-credentials: false
       - name: Install me
         run: |
           set -o pipefail
           mkdir -p "$HOME/.local/bin"
           curl -fsSL https://install.memory.build | ME_INSTALL_DIR="$HOME/.local/bin" sh
-      - name: Import
+      - name: Import git history
         env:
           ME_API_KEY: ${{ secrets.ME_API_KEY }}
+          ME_SPACE: ahkgk250pmzh
         run: |
-          "$HOME/.local/bin/me" import ci
+          "$HOME/.local/bin/me" import git --tree /share/projects/memory-engine
+      - name: Import docs
+        env:
+          ME_API_KEY: ${{ secrets.ME_API_KEY }}
+          ME_SPACE: ahkgk250pmzh
+        run: |
+          "$HOME/.local/bin/me" import docs . --git-aware --prune --tree /share/projects/memory-engine

packages/cli/commands/project-ci.test.ts

@@ -62,6 +62,8 @@ describe("me ci install", () => {
     expect(workflow).toContain("ME_API_KEY: ${{ secrets.ME_API_KEY }}");
     expect(workflow).toContain("ME_SPACE: team-memory");
     expect(workflow).toContain("ME_SERVER: https://me.example.test");
+    expect(workflow).toContain("permissions:\n  contents: read");
+    expect(workflow).toContain("persist-credentials: false");
     expect(workflow).toContain("import git --tree /share/projects/widgets");
     expect(workflow).toContain(
       "import docs . --git-aware --prune --tree /share/projects/widgets",

packages/cli/commands/project-ci.ts

@@ -67,6 +67,9 @@ on:
   push:
   workflow_dispatch: {}
 
+permissions:
+  contents: read
+
 concurrency:
   group: me-import-\${{ github.ref }}
   cancel-in-progress: true
@@ -79,6 +82,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Install me
         run: |
           set -o pipefail