A repository owner wants to mitigate the anti-pattern of allowing agent-generated pull requests to bypass the same validation path as human-authored pull requests. The workflow should run automatically for pull requests into main, use the minimum permissions needed to read repository contents, and execute the validation script. Which option completes the workflow?

The correct option ensures the workflow triggers on pull requests, has appropriate read permissions, and executes the validation script. pullrequest is the correct event to trigger the workflow when a pull request is opened or updated, aligning with the requirement to validate agent-generated PRs. contents: read grants the minimum necessary permission to read repository files, including the validation script, adhering to the principle of least privilege. run is the correct keyword to execute a shell command or script within a step. Incorrect options: workflowdispatch is for manual triggering, not automatic PR validation. pull-requests is not a valid permission scope. uses is for calling actions, not running scripts. push triggers on code pushes, not specifically pull requests. actions is a permission scope for managing GitHub Actions, not reading repository content. with is used to provide inputs to actions, not to execute scripts directly. schedule triggers workflows at specified times, not for PR validation. checks is a permission scope related to check runs, not for reading repository content. env is for defining environment variables, not for executing scripts.