testing: use minimal permissions with workflows and use yoshi token for comments & deploys

[grayside]

New bot identity is being sorted out for samples repos. Wait on that.