git-trunk-branch-and-pr-automation

High-severity workflow risk: same-repository, non-bot pull requests can modify .github/scripts/normalize-pr-title.js, which the workflow executes with pull-requests: write and issues: write permissions. This permits PR-controlled code to misuse the workflow's GitHub token; no malicious payload or external endpoint is shown, and the script itself is not provided. The validate-only path avoids checkout and execution of fork code.