Use default integrity filtering for smoke GitHub reads (#1282)

* Keep untrusted GitHub metadata out of workflow agents

* Revert "Keep untrusted GitHub metadata out of workflow agents"

This reverts commit 4e46075.

* Use public-repository default integrity for smoke PR reads

Author: davidslater

.github/workflows/smoke-claude-standalone.lock.yml

@@ -24,8 +24,8 @@ tools:
     - "*"
   github:
     mode: gh-proxy
-    # This metadata check must include PRs from bots and external contributors.
-    min-integrity: none
+    # The public-repository default permits collaborator and same-repository PRs.
+    min-integrity: approved
     allowed-repos: [github/gh-aw-threat-detection]
 runtimes:
   go:

.github/workflows/smoke-claude-standalone.md

@@ -25,8 +25,8 @@ tools:
     - "*"
   github:
     mode: gh-proxy
-    # This metadata check must include PRs from bots and external contributors.
-    min-integrity: none
+    # The public-repository default permits collaborator and same-repository PRs.
+    min-integrity: approved
     allowed-repos: [github/gh-aw-threat-detection]
   web-fetch:
 runtimes:

.github/workflows/smoke-codex-standalone.lock.yml

@@ -22,8 +22,8 @@ tools:
     - "*"
   github:
     mode: gh-proxy
-    # This metadata check must include PRs from bots and external contributors.
-    min-integrity: none
+    # The public-repository default permits collaborator and same-repository PRs.
+    min-integrity: approved
     allowed-repos: [github/gh-aw-threat-detection]
 runtimes:
   go: