fix(workflows): grant anomaly triage caller permissions

[ArchonVII]

Summary

Grant the managed anomaly-triage caller the exact token scopes required by its reusable workflow. Read-default consumers currently fail during reusable-workflow expansion before GitHub creates jobs, so this also adds a structural regression guard that makes removal or widening of the permission block detectable.

Verification

• TDD regression: npm test -- scripts/workflow-structure.test.mjs failed 1/22 on the missing caller block, then passed 22/22 after the YAML change.

  command: npm test -- scripts/workflow-structure.test.mjs
  location: local
  result: RED 1 failed / 21 passed; GREEN 22 passed / 0 failed
  timestamp: 2026-07-09T21:00:26-05:00
  

• Workflow syntax: actionlint examples/anomaly-triage.yml exited 0 with no findings.

  command: actionlint examples/anomaly-triage.yml
  location: local
  result: exit 0; no findings
  timestamp: 2026-07-09T21:03:28-05:00
  

• Full provider suite: npm test completed with 9 files and 180/180 tests passing.

  command: npm test
  location: local
  result: 9 files passed; 180 tests passed; 0 failed
  timestamp: 2026-07-09T21:03:28-05:00
  

Verification Notes

The regression asserts the complete top-level caller permission block equals contents: read, pull-requests: write, and issues: write; it does not merely search for one write scope. git diff --check also exited 0 with working-tree LF-to-CRLF warnings only. Live read-default consumer routing and idempotency remain part of the issue's downstream propagation phase, so this PR starts as a draft checkpoint.

Docs / Changelog

Added .changelog/unreleased/106-anomaly-triage-write-permissions.md and appended the issue, branch, verification, and propagation state to docs/repo-update-log.md.

Plan/status artifacts: narrowed to the still-open repo-template, archon-setup snapshot, affected-consumer, and live-smoke phases; the lane-local scratch plan is ignored and will be removed before ready-for-review.

Owner decisions this lane: none

Linked Issue

Refs #106

Risks

• Risk level: Low; the caller grants only the three scopes already requested by the reusable triage job.
• Rollback: Revert this PR to restore the prior caller, recognizing that read-default consumers will again fail at workflow startup.
• Follow-ups: Sync repo-template, refresh archon-setup snapshots, update the eight broken default-branch callers, and prove live idempotent routing before closing fix(workflows): declare write permissions in anomaly triage caller #106.