fix(workflows): declare write permissions in anomaly triage caller

[ArchonVII]

Summary

The managed examples/anomaly-triage.yml caller omits an explicit permissions block. Consumers whose repository default is a read-only GITHUB_TOKEN fail at workflow startup because the called reusable job requests pull-requests: write and issues: write.

Evidence

• Consumer: ArchonVII/sales (default_workflow_permissions: read).
• Failed runs: https://github.com/ArchonVII/sales/actions/runs/29062244365 and https://github.com/ArchonVII/sales/actions/runs/29062294338.
• Both runs concluded startup_failure with zero jobs and no logs.
• sales/.github/workflows/anomaly-triage.yml matches github-workflows/examples/anomaly-triage.yml and declares no top-level permissions.
• The reusable workflow at .github/workflows/anomaly-triage.yml@v1 requires contents: read, pull-requests: write, and issues: write for its triage job.
• actionlint examples/anomaly-triage.yml is clean; this is a token-permission contract gap, not YAML syntax.

Reproduction

1. Install examples/anomaly-triage.yml in a repository whose Actions default workflow permissions are read-only.
2. Open or update a PR that changes .archon/anomalies-thispr.md.
3. Observe the Anomaly triage workflow fail before any job starts.

Expected behavior

The managed caller explicitly grants the least privileges required by the reusable workflow, and anomaly entries are routed to PR comments/issues.

Actual behavior

The workflow ends as startup_failure; anomalies are not routed and no diagnostic log is available.

Acceptance Criteria

• Add an explicit least-privilege caller block: contents: read, pull-requests: write, issues: write.
• Verify the example with actionlint.
• Refresh the archon-setup snapshot from the provider rather than editing the snapshot first.
• Update affected consumers through the normal updater path.
• Exercise a consumer PR containing a correctly formatted anomaly entry and confirm the workflow creates jobs and routes it idempotently.

Impact

Medium — off-task defects silently remain untracked in every read-default consumer using this managed caller. Required gates are unaffected, so feature PRs can merge while anomaly routing is broken.

[ArchonVII]

Completed across provider, integrator, and every opted-in consumer.

Provider and release:

• fix(workflows): grant anomaly triage caller permissions #107 merged the exact caller permissions (contents: read, pull-requests: write, issues: write).
• fix(anomaly-triage): parse documented metadata fields #111 fixed the documented bold-field parser compatibility exposed by the live proof.
• github-workflows@v1 now resolves to f34893a3b67e5c17e59ca1413e92077833fdc571.

Integrator/baseline:

• fix(workflows): grant anomaly triage caller permissions repo-template#154
• fix(snapshots): propagate anomaly triage permissions (#342) archon-setup#343, #345, and #347

Consumer delivery:

• ArchonVII/jma-ui#78
• ArchonVII/comfyui-companion#350
• ArchonVII/lifeloot#138
• ArchonVII/sales#36
• ArchonVII/consail-economy#4
• civ-sim was audited already effective with equivalent job-level scopes; no change was required.

Live proof:

• ArchonVII/sales Actions run https://github.com/ArchonVII/sales/actions/runs/29069591708 started a real triage / triage job and succeeded twice.
• Final state retained exactly one summary marker and one related marker, reused the legitimate unrelated issue ArchonVII/sales#40, and created no duplicate issue.
• Temporary proof ArchonVII/sales#39 was closed without merge; verification fixture fix(required-gate): honor disabled validation inputs #41 was closed.

All delivery PRs were green and review/thread-clean before merge.