AI codebase review

fix: sanitise snapshot follow mode; least-privilege CI token

The scan-info view printed the snapshot's "follow" metadata string
unsanitised (the canvas filter was the only defence). The CI workflow
ran with the repository's default GITHUB_TOKEN permissions; it only
needs to read the code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -2,6 +2,8 @@ name: ci
 on:
   push:
   pull_request:
+permissions:
+  contents: read
 jobs:
   test:
     strategy:

internal/tui/infoview.go

@@ -110,7 +110,7 @@ func (v *infoView) paint(m *Model, cv *Canvas, r treemap.Rect) {
 	}
 	line("Exclusions", excl, value)
 	line("One filesystem", fmt.Sprint(st.OneFileSystem), value)
-	line("Follow symlinks", st.Follow, value)
+	line("Follow symlinks", textutil.Sanitize(st.Follow), value)
 	line("Size mode", m.sizeMode.String(), value)
 	units := "IEC (1024)"
 	if textutil.SI {