fix(ci): drop unused pull-requests scope from kilo-app CI

[iscekic]

Summary

What: one-line fix — delete pull-requests: read from the permissions: block of
.github/workflows/kilo-app-ci.yml.

Why: the scheduled kilo-app Release workflow has been failing with startup_failure (zero
jobs, run never starts) since #4695 — e.g. scheduled run
30336828117. Root cause: a called
reusable workflow may only downgrade the caller-granted GITHUB_TOKEN scopes, never elevate
them. The caller kilo-app-release.yml declares permissions: contents: write and nothing else
(every other scope is implicitly none), while the called kilo-app-ci.yml requested
contents: read plus pull-requests: read. GitHub rejects the run at workflow-validation
time.

How: pull-requests: read is used by nothing in kilo-app-ci.yml (no job references
GITHUB_TOKEN, github.token, gh, or secrets.* — the jobs are pure
checkout + pnpm + typecheck/lint/format/check-unused/test). Dropping the unused scope from the
callee is the least-privilege resolution: the alternative — granting pull-requests: read in the
release caller — would hand an unused scope to the workflow that pushes release tags and drives
App Store submission. The workflow's own push/pull_request triggers are unaffected
(contents: read stays, and the jobs use no token at all).

Also in this PR, as a separate commit: a workflow-tooling repair to
.kilo_workflow/dispatch-role.sh (tmux window target now <session>: — prefix-matching against
window names broke every role dispatch from a session named after the section) plus its committed
learning. Unrelated to the defect; discovered mid-run and shipped per the workflow's self-fix
rule.

Possible follow-up (not this PR): the release workflow's validate job runs on every scheduled
invocation even when check-changes decides should_build=false, so a no-change night still
burns five CI jobs.

Verification

• Reproduced the defect on the unmodified baseline: dispatching kilo-app-release.yml on a
  throwaway branch at the broken head produced run
  30356820904 — startup_failure,
  0 jobs, ~1s, "This run likely failed because of a workflow file issue" — the exact signature of
  the scheduled failure (branch deleted after the repro).
• Positive verification on this branch: workflow_dispatch of kilo-app-release.yml at head
  c559d6fde produced run
  30361039476 —
  conclusion: success, 7 jobs. check-changes succeeded and emitted should_build=true (232
  changed apps/mobile/** paths since the last release tag); all five validate / * jobs
  (typecheck, lint, format-check, check-unused, test) ran green; build-and-submit was
  skipped — with should_build=true on a non-main ref, the skip is attributable solely to the
  github.ref == 'refs/heads/main' guard, proving it intact.
• kilo-app CI on its own triggers: covered by this PR's own pull_request run (the PR
  touches .github/workflows/kilo-app-ci.yml, which is in that workflow's paths filter).
• No local checks apply to a one-line workflow-YAML deletion; the dispatch runs above are the
  verification.

Visual Changes

N/A

Reviewer Notes

The entire defect fix is the single deleted line in kilo-app-ci.yml. The second commit
(.kilo_workflow/) is intentional workflow tooling, recorded as a binding decision in the run's
plan — please don't read it as scope creep.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• .github/workflows/kilo-app-ci.yml
• .kilo_workflow/dispatch-role.sh
• .kilo_workflow/learnings/tmux-new-window-index-in-use-name-prefix-collision.md

---

_{Reviewed by claude-sonnet-5 · Input: 14 · Output: 2.2K · Cached: 244.6K}

_{Review guidance: REVIEW.md from base branch main}