[Pavithran-R-A]

Why

The controlled live-validation workflow set GH_TOKEN at job scope, exposing GitHub's ephemeral read-only credential to package install, build, tests, and other commands that did not need it. Existing workflow policy tests checked the number of token references but not their placement.

Changes

• Remove job-level GH_TOKEN from both the no-key matrix and the live-model job.
• Expose the token only on each trusted scripts/e2e-validation.mjs driver step, which needs gh to read a public GitHub issue. That driver already strips tokens from its public Git, package and model-controlled workspace child commands; the main workflow install, build, audits, deterministic suite and sandbox proof are now token-free.
• Strengthen the security policy test to reject job-level exposure and reject additional token-bearing steps.

Scope and evidence

• Parent main was ae64aeac3061afd718369f0cc62b0cc73ad1d863, which already passed six-platform CI and eight scripted customer journeys.
• Static layout verification confirmed that each job has no job-scoped token, and exactly one named E2E driver step has a step-scoped token.
• CI is requested via this PR; no paid BharatCode request or credentialed live workflow dispatch is made.

Release conditions

Do not merge until full hosted matrix and scripted customer tests pass. After merge, requalify exact main SHA before live-model dispatch. Preserve the manual-only input, model request ceiling of 12, sandbox boundary, and no-publication policy.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[linear-code]

PAV-160