Refer to https://docs.google.com/document/d/1txFFr-X2gg7EGfVfaJjBJZRPWYg6wGxTHne7cD85Ipk/edit?usp=sha ring Lucerne needs to implement Planned change 5 and Technical requirement 5. The required report-policy check must run when files under release-reports/** change. The workflow validates report metadata and comments nowhere, commits nothing, and uploads no SARIF. Which option completes the workflow?

The correct option aligns with the requirements for the workflow. "Missing value 1 = 'release-reports/'" correctly specifies that the workflow should trigger when files under release-reports/ change, as stated in the problem description. "Missing value 2 = read" and "Missing value 3 = read" are appropriate because the workflow only validates report metadata and does not modify repository content or pull requests, thus requiring only read permissions. The other options are incorrect because they either specify the wrong path for triggering the workflow, assign excessive write permissions when only read is needed, or assign none permissions when read is required for checkout and validation. For instance, reports/ is too broad, and analysis/thresholds/ or .github/agent-state/ are irrelevant to the specified release-reports/ path. Assigning write permissions when not needed violates the principle of least privilege.