Model-Generated GitHub Actions Need a Permission Gate

A model can write a valid GitHub Actions workflow that still leaks a secret. Lint the syntax, then...