The agent job is always getting "contents: read" to access the agent file markdown, even if this is not declared in the permissions:...

This should not be needed - it should be possible to get the markdown in the activation job