.github: enable excessive-permissions audit — final #21132 cleanup

[lystopad]

Final PR of the zizmor excessive-permissions cleanup — closes #21132 (with #22688).

Follows #22662, #22677, #22687 (and the dead-workflow removal #22688).

What

1. test-fuzz.yml — move issues: write from the workflow level to the notify job (the only job that opens/updates the nightly-fuzz tracking issue). The fuzz matrix job keeps contents: read.
2. .github/zizmor.yml — replace the blanket excessive-permissions: disable: true with a per-file ignore of just ci-gate.yml, and enable the audit for every other workflow.

Why ci-gate is ignored rather than scoped

ci-gate orchestrates the reusable test leaves. Per GitHub's rules, a called workflow's GITHUB_TOKEN permissions are capped by the caller — so ci-gate's workflow-level grants are not "for itself", they're the ceiling every leaf inherits:

• actions: write is the cap that lets all ~12 self-cancelling leaves (scoped in .github: scope actions: write to merge-queue self-cancel jobs (#21132) #22677/.github: least-privilege permissions for docker/hive/kurtosis workflows (#21132) #22687) actually run gh run cancel on merge-queue failure. Dropping it silently breaks fast-cancel and the gate stalls.
• pull-requests: write drives the gate's own dequeuePullRequest GraphQL mutation (GitHub doesn't auto-remove UNMERGEABLE queue entries), and is also the cap for sonar's inherited pull-requests: read.

Neither can be scoped to a single job without adding per-job permissions caps to every leaf-call job on the merge gate — high risk for no real privilege gain. The in-file comment documents this, mirrored into the ignore justification.

Verification

• Full repo, real .github/zizmor.yml, with docker-tags.yml removed (as .github: remove dead docker-tags workflow #22688 does): zizmor → exit 0, "No findings to report" (17 ignored, 299 suppressed).
• On this branch alone (docker-tags still present until .github: remove dead docker-tags workflow #22688 merges): exit 13 — one medium docker-tags finding that .github: remove dead docker-tags workflow #22688 removes; the gate passes regardless (< 14).
• actionlint clean; make lint = 0 issues.

Merge order

Pairs with #22688 (docker-tags removal). Either order is safe (the gate passes both ways); once both land, excessive-permissions reports zero findings and #21132 can close. The only remaining zizmor exceptions repo-wide are the deliberate policy ones (unpinned-uses, concurrency-limits) and the justified per-file ignores (cache-poisoning, secrets-inherit, and now excessive-permissions → ci-gate).