fix(ci): correct the documentation.yml permissions rationale — build-image defaults to true

The comment claimed `packages: write` was needed only because GitHub statically
validates a callee's declared job permissions, and that the `image` job "never
runs" here. That is wrong on the second half.

`build-image` in ConductionNL/.github/.github/workflows/documentation.yml is
`type: boolean, default: true`, and none of the callers pass it. So the `image`
job DOES run on a push to `documentation`, and it really does `docker buildx`
push to GHCR. `packages: write` is load-bearing at RUNTIME, not merely
statically — dropping it would 403 that push.

Comment only; the permissions block itself is unchanged and was already correct.

Author: Conduction Release Bot

.github/workflows/documentation.yml

@@ -15,10 +15,15 @@ jobs:
     #   deploy contents: write   (peaceiris/actions-gh-pages pushes to gh-pages)
     #   image  contents: read, packages: write  (buildx push to GHCR)
     #
-    # ⚠️ `packages: write` stays even though `build-image` is not set here, so
-    # the `image` job never runs. GitHub validates the callee's DECLARED job
-    # permissions against this ceiling before dispatch — including jobs an `if:`
-    # will skip — so dropping it makes the whole call fail to start.
+    # ⚠️ `packages: write` is load-bearing at RUNTIME, not merely statically:
+    # the callee's `build-image` input DEFAULTS TO TRUE, so the `image` job
+    # really does run on a push to `documentation` and really does push to
+    # GHCR. Dropping it 403s that push.
+    #
+    # It would be required even if that job were disabled, because GitHub
+    # validates the callee's DECLARED job permissions against this ceiling
+    # before dispatch — including for jobs an `if:` will skip — so a too-low
+    # ceiling makes the whole call fail to start rather than run with less.
     permissions:
       contents: write
       packages: write