* ci: move Lock Threads to dessant/lock-threads v6.0.2
The pinned v4.0.0 rejects the job token: it validates github-token at
100 characters or fewer, and Actions tokens are now longer, so every
scheduled run fails with '"github-token" length must be less than or
equal to 100 characters long'.
v6.0.2 accepts them. The workflow now matches the one phishing already
runs: empty top-level permissions, issues/pull-requests write on the job
only, process-only issues and PRs (discussions write is no longer
granted), and a 10 minute timeout. Each repository keeps its schedule.
* ci: remove workflows that cannot run
push-master.yml listens on master, which no longer exists here (the
default branch is main), and needs GH_PAT_BOT and NPM_TOKEN, which are
not set. It has never run. Releases are published by hand to the next
tag first and verified against the registry before latest moves, so
this job is not the release path and would bypass that order if it were
revived.
CodeQL actions/missing-workflow-permissions: lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
SatoshiQaziMuhammed