Permission Hardening for a Fleet of Unattended Runs

Your team now has three unattended mechanisms running against the same production monorepo: a desktop scheduled task doing a daily dependency audit, a cloud routine doing nightly issue triage, and a /loop a senior engineer leaves running overnight to babysit a long migration PR. Write a permission-hardening checklist that applies specifically to this fleet — not a generic "be careful" list, but concrete steps tied to how each mechanism's permission model actually works.