test(review): lock split target and central mention authority

tests/test_agent_mention_downstream_idempotency.py

@@ -12,14 +12,15 @@
 
 
 def test_router_can_read_durable_central_artifacts() -> None:
-    """Both local routing and sibling sweeping receive actions read access."""
+    """Target reads and central dispatch keep distinct least-privilege authorities."""
 
     text = ROUTER_WORKFLOW.read_text(encoding="utf-8")
     local, sweep = text.split("\n  sweep-organization-agent-mentions:\n", 1)
     assert "permissions:\n      actions: read" in local
     assert "permissions:\n      actions: read" in sweep
     assert "AGENT_DISPATCH_TOKEN: ${{ github.token }}" in local
     assert "AGENT_DISPATCH_TOKEN: ${{ github.token }}" in sweep
+    assert 'export AGENT_DISPATCH_TOKEN="$TARGET_REPOSITORY_TOKEN"' not in sweep
 
 
 def test_downstream_workflows_claim_artifacts_and_coalesce_by_pull_request() -> None:

tests/test_agent_mention_workflow_contract.py

@@ -48,6 +48,7 @@ def test_workflow_uses_local_event_and_central_sweep_with_job_scoped_writes() ->
     assert "secrets.OPENCODE_APPROVE_TOKEN" in sweep
     assert "TARGET_REPOSITORY_SOURCE" in sweep
     assert "AGENT_DISPATCH_TOKEN: ${{ github.token }}" in sweep
+    assert 'export AGENT_DISPATCH_TOKEN="$TARGET_REPOSITORY_TOKEN"' not in sweep
     assert "agent_mention_sweep.py" in sweep