[create-croco-app] Keep generated browser-test workflows least-privileged

[kang-heewon]

Priority

P0

Problem

The generated browser-test workflow omits explicit minimal token permissions and persists checkout credentials. PR-controlled generated-app code can consequently inherit broader token access than intended.

Evidence

packages/create-croco-app/templates/spa-be-split/.github/workflows/browser-tests.yml has no permissions: { contents: read } and its checkout step lacks persist-credentials: false. The root CI workflow applies these safeguards.

Desired outcome

Every generated browser-test workflow runs with read-only contents access and does not retain checkout credentials.

Implementation path

• Declare top-level/job contents: read permissions.
• Set persist-credentials: false on checkout.
• Add template workflow policy validation.

Acceptance criteria

• Generated workflow YAML specifies least-privilege permissions.
• Checkout credentials are disabled.
• The scaffold smoke rejects regression in either control.

Validation

• Generate the affected app and parse its workflow in a template test.
• Run pnpm --filter @croco/create-croco-app test and pnpm check.

Scope

Does not add deployment permissions or change user-authored workflows.