ci(trunk): refresh caller workflow

[ss-o]

Refresh the Trunk caller workflow to the standardized org shape (Batch A: deprecated token wiring), per z-shell/.github#408.

Changes

• Remove the deprecated scheduled upload job and its trunk-token: ${{ secrets.TRUNK_TOKEN }} wiring (Trunk Code Quality web-app uploads are retired).
• Plain-text workflow name Trunk Code Quality (drops emoji name).
• Add top-level permissions: contents: read and explicit job permissions (actions: read, checks: write).
• Add concurrency to cancel stale push/PR runs.
• Pass arguments: --no-progress for readable logs.
• Preserve the existing weekly schedule (0 05 * * 5); the single check job now also covers scheduled runs.

Matches the established rollout shape (e.g. z-shell/zbrowse#43, z-shell/H-S-MW#4).

Refs z-shell/.github#408

[Copilot]

Pull request overview

Updates the repository’s Trunk Code Quality GitHub Actions caller workflow to match the standardized z-shell org rollout shape by removing deprecated upload/token wiring and tightening permissions/concurrency for more predictable CI runs.

Changes:

• Removes the deprecated scheduled “upload” job and TRUNK_TOKEN secret wiring; the remaining check job now runs for push/PR/schedule/dispatch.
• Standardizes workflow/job naming and adds --no-progress arguments for clearer logs.
• Adds explicit permissions and concurrency to reduce privilege and cancel stale runs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.