ci: fix dependency-review permission cap and stop inherited fork noise

.github/workflows/audit.yml

@@ -175,12 +175,18 @@ jobs:
 
           bun run parse-audit.ts > slack-payload.json
 
+      # This fork has no Slack webhook, so an unguarded post failed the whole
+      # audit every night even when the audit itself passed.
       - name: Send to Slack
         if: always()
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
         run: |
-          curl -X POST \
+          if [ -z "${SLACK_WEBHOOK_URL:-}" ]; then
+            echo "SLACK_WEBHOOK_URL is not configured; skipping notification."
+            exit 0
+          fi
+          curl -fsS -X POST \
             -H 'Content-Type: application/json' \
             -d @slack-payload.json \
-            $SLACK_WEBHOOK_URL
+            "$SLACK_WEBHOOK_URL"

.github/workflows/dependency-review.yml

@@ -10,4 +10,5 @@ jobs:
   dependency-review:
     permissions:
       contents: read
+      pull-requests: write # the reusable job posts the review summary on the PR
     uses: NDDev-it-com/ci-workflows/.github/workflows/public-dependency-review.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0