ci: switch sync-readme to check-only mode

Instead of auto-pushing a fix commit (which doesn't re-trigger required
checks due to GITHUB_TOKEN anti-loop policy), the workflow now just
fails if the README is out of sync. Run `bash scripts/sync-readme.sh`
locally and push to fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dogmar

.github/workflows/sync-readme.yml

@@ -13,7 +13,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   sync:
@@ -22,7 +22,6 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.head_ref }}
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: voidzero-dev/setup-vp@v1
         with:
@@ -34,34 +33,10 @@ jobs:
       - name: Run sync script
         run: vp run sync-readme
 
-      - name: Commit and push if changed
-        id: sync
+      - name: Fail if README is out of sync
         run: |
-          if git diff --quiet README.md; then
-            echo "pushed=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add README.md
-          git commit -m "docs: sync README code blocks"
-          if ! git push; then
-            echo "::error::README is out of sync and could not push fix to branch"
+          if ! git diff --quiet README.md; then
+            echo "::error::README is out of sync. Run 'bash scripts/sync-readme.sh' locally and push."
+            git diff README.md
             exit 1
           fi
-          echo "pushed=true" >> "$GITHUB_OUTPUT"
-
-      # GitHub's anti-loop policy: pushes made with the default GITHUB_TOKEN
-      # don't fire `pull_request`/`push` events, so the synced commit would
-      # land on the PR with no CI run. Re-dispatch CI manually so the new HEAD
-      # gets validated. (For a "proper" fix that fires the synchronize event,
-      # plumb a PAT/App token through the checkout step's `token:` input.)
-      - name: Re-trigger CI on synced commit
-        if: steps.sync.outputs.pushed == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BRANCH: ${{ github.head_ref }}
-        run: |
-          gh workflow run ci.yml --ref "$BRANCH"
-          gh workflow run sync-readme.yml --ref "$BRANCH"
-          gh workflow run pr-title.yml --ref "$BRANCH"