Agent Skills: permissioning-ci-workflows

Give a CI job exactly the credentials it needs and know when it has none — declaring `permissions:` explicitly because the default GITHUB_TOKEN scope is a repo setting, reading the 403's x-accepted-github-permissions header instead of guessing the missing scope, one API call needing two scopes, a fork pull request getting a read-only token and no repository secrets, event-conditioned steps that skip on the re-run and turn a job green without fixing it, why `pull_request_target` is not the workaround, and preferring a check that needs no credential at all. Use when a workflow step comments on a PR, pushes a commit, opens an issue, uploads a report, calls another repository's API, or fails 403 while every build and test step passes.