Fix agent authorship label workflow permissions

[haasonsaas]

Summary

Fixes the reusable authorship-label workflow permissions after rollout PRs showed PR label writes require pull-requests: write in addition to issues: write.

Updates the reusable workflow, workflow template, and convention doc snippet together.

Related rollout: evalops/.github#12
Parent convention: evalops/.github#8

Test Plan

• ruby -c .github/scripts/classify-agent-authorship.rb
• YAML validation for issue templates/workflows/workflow templates
• JSON validation for workflow template metadata
• actionlint .github/workflows/*.yml .github/workflow-templates/*.yml
• git diff --check

[cursor]

PR Summary

Low Risk
Low risk: only adjusts GitHub Actions permission scopes to match required label-write behavior; no runtime logic changes.

Overview
Updates the agent-authorship labeling workflow/template to request pull-requests: write (instead of read) so it can reliably apply/remove PR labels.

Keeps documentation in profile/AGENT_AUTHORSHIP.md in sync with the new required permissions.

^{Reviewed by Cursor Bugbot for commit abd61f5. Bugbot is set up for automated code reviews on this repo. Configure here.}