fix(workflow): Restrict Gemini to read-only gh commands

- Change "run_shell_command(gh issue)" to specific read-only commands:
  - "run_shell_command(gh issue view)"
  - "run_shell_command(gh issue list)"
- Prevents Gemini from using write operations like:
  - gh issue edit
  - gh issue close
  - gh issue comment
  - gh issue create

Repository files are already read-only (no write_file, edit_file, or
shell redirects in allowlist). This completes full read-only enforcement
at the tool level, complementing the prompt instructions.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: julienld

.github/workflows/gemini-triage.yml

@@ -348,7 +348,8 @@ jobs:
                   "run_shell_command(tail)",
                   "run_shell_command(git log)",
                   "run_shell_command(git show)",
-                  "run_shell_command(gh issue)",
+                  "run_shell_command(gh issue view)",
+                  "run_shell_command(gh issue list)",
                   "google_web_search"
                 ]
               }