fix(ci): grant pull-requests write to fork label job (#2542)

.github/scripts/claude-code-review-workflow-contract_test.py

@@ -155,6 +155,7 @@ class ClaudeCodeReviewWorkflowContractTest(unittest.TestCase):
             label_job,
         )
         self.assertIn("issues: write", label_job)
+        self.assertIn("pull-requests: write", label_job)
         self.assertIn("github.rest.issues.addLabels", label_job)
         self.assertIn(
             "const labels = ['safe-to-review', 'safe-to-test'];",

.github/workflows/claude-code-review.yml

@@ -86,6 +86,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       issues: write
+      # issues.addLabels on a *pull request* requires the PR-scoped
+      # permission; issues: write alone 403s with "Resource not accessible
+      # by integration" (see kdlbs/kandev#2532 and siblings).
+      pull-requests: write
 
     steps:
       - name: Add automatic fork approval labels