ci(v1.x): sync bot caller workflows with main

[heskew]

claude-code-action validates a PR's caller workflows against the default branch, so the drifted copies on v1.x fail the review check on every v1.x-targeted PR. This syncs all five callers to the content of #218 (pin be549ad + ready_for_review triggers) — byte-identical to main once #218 merges, so merge #218 first, then this.

Going forward: any pin bump on main re-drifts v1.x until re-synced.

🤖 Generated with Claude Code

https://claude.ai/code/session_01S94XethbGXpAb4DRKMD4kt

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[claude]

Reviewed; no blockers found.

[github-actions]

2 blockers found. Prior 2 finding(s) still unresolved.

1. Missing permissions for the auth gate and agent edits

File: .github/workflows/claude-mention.yml:35
What: The mention job is missing the permissions: block required for the OIDC-based auth gate and for the agent to commit changes.
Why it matters: The latest version of the reusable workflows (SHA be549ad...) uses an OIDC-based auth gate to exchange GitHub credentials for an App installation token. Without id-token: write, this exchange will fail. Additionally, without contents: write, the agent will be unable to commit or push the code changes it generates when responding to a mention.
Suggested fix: Add the following permissions block to the mention job, mirroring the structure in claude-review.yml but including contents: write and issues: write:

    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write

2. Missing permissions for the auth gate and PR creation

File: .github/workflows/claude-issue-to-pr.yml:33
What: The work job is missing the permissions: block required for the auth gate and for the agent to create pull requests.
Why it matters: Similar to the mention handler, the "Issue to PR" workflow requires id-token: write for OIDC authentication. It also needs contents: write and pull-requests: write to create branches and push the resulting PRs. Without these, the workflow will fail to perform its primary function.
Suggested fix: Add the following permissions block to the work job:

    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write

[heskew]

Dispositions for the 2 review blockers (both the same class):

Declined on this PR by construction. #217 is a byte-identity sync of main's caller files onto v1.x — the caller validation compares against the default branch, so any divergence here re-breaks the exact failure this PR fixes. Nothing repo-behavioral can be "fixed" in a sync PR; changes go to main and re-sync.

On the substance, the findings also over-call: the mention/issue-to-pr callers have never carried a permissions: block on main, and harper's byte-identical callers run this pipeline in production daily — the reusable's jobs declare their own grants, which apply under the repos' default workflow permissions. The auth gate mints an App installation token from org secrets (create-github-app-token), not OIDC. So "will fail to authenticate / push" is incorrect as stated.

The kernel worth keeping: making the grants caller-explicit (as the review callers already do) removes the dependence on the repo-default setting. Queued as a small fleet-wide follow-up against main.