fix(ci): restore checkout permissions

- Grant GITHUB_TOKEN contents:read so actions/checkout can fetch.

- Reduce lint complexity in resolveCreateInputs.

Author: codex

.github/workflows/check.yml

@@ -11,7 +11,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   build:

.github/workflows/snapshot.yml

@@ -5,7 +5,8 @@ on:
     branches: [main, next-minor, next-major]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   snapshot:

packages/app/src/docker-git/menu-create.ts

@@ -108,9 +108,9 @@ export const resolveCreateInputs = (
     repoRef: values.repoRef ?? "main",
     outDir,
     secretsRoot,
-    runUp: values.runUp ?? true,
-    enableMcpPlaywright: values.enableMcpPlaywright ?? false,
-    force: values.force ?? false
+    runUp: values.runUp !== false,
+    enableMcpPlaywright: values.enableMcpPlaywright === true,
+    force: values.force === true
   }
 }
 

packages/app/src/docker-git/menu-render.ts

@@ -25,8 +25,7 @@ export const renderStepLabel = (step: CreateStep, defaults: CreateInputs): strin
     Match.when("runUp", () => `Run docker compose up now? [${defaults.runUp ? "Y" : "n"}]`),
     Match.when(
       "mcpPlaywright",
-      () =>
-        `Enable Playwright MCP (Chromium sidecar)? [${defaults.enableMcpPlaywright ? "y" : "N"}]`
+      () => `Enable Playwright MCP (Chromium sidecar)? [${defaults.enableMcpPlaywright ? "y" : "N"}]`
     ),
     Match.when(
       "force",