Add least-privilege permissions to the shutdown package PR-closing workflow

[coderabbitai]

Summary

Add explicit least-privilege GITHUB_TOKEN permissions to the shutdown package pull-request closing workflow.

Do not pin superbrothers/close-pull-request@v3 as part of this follow-up.

Rationale

The workflow comments on and closes pull requests. Its required permissions should be explicit and limited to the GitHub API operations that it performs.

Affected area

• src/Shutdown/.github/workflows/close-pull-request.yml

Required changes

Add a top-level permissions block with only:

• issues: write
• pull-requests: write

Keep superbrothers/close-pull-request@v3 unchanged.

Acceptance criteria

• The workflow declares only issues: write and pull-requests: write.
• The workflow can comment on and close newly opened pull requests.
• The action reference remains superbrothers/close-pull-request@v3.

Backlinks

• Pull request: Add foundation-shutdown #13
• Review comment: Add foundation-shutdown #13 (comment)

Requested by: @defunctl