claude.yml: actions: read -> write for the same cache-permission gap

Same anthropics/claude-code-action cache-write gotcha as the previous
commit's claude-code-review.yml fix (Postgres-Extensions/cat_tools PR #47) --
this workflow calls the same action, so its own internal setup hits the
same silent "Cache reservation failed" warning without actions: write.
`write` still covers the existing "read CI results" need (write implies
read here), so this replaces the read with write rather than adding a
duplicate key.

claude.yml does NOT need the --allowedTools inline-comments fix from the
previous commit: it never sets prompt: (it responds to actual @claude
mention text, not agent mode), so that specific gotcha doesn't apply here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: jnasbyupgrade

.github/workflows/claude.yml

@@ -31,7 +31,14 @@ jobs:
       pull-requests: read
       issues: read
       id-token: write
-      actions: read # Required for Claude to read CI results on PRs
+      # write (not just read) despite the name: `write` includes read access
+      # to CI results, AND there's no narrower scope for cache-write alone --
+      # without it, claude-code-action's own internal setup silently fails to
+      # save its Actions cache ("Cache reservation failed: cache write
+      # denied: token has no writable scopes"), a warning not a hard
+      # failure, so the job still completes and looks fine, just
+      # slower/uncached every run. Don't "tighten" this back down to `read`.
+      actions: write
     steps:
       - name: Checkout repository
         # Intentionally tracks the major-version tag (not a pinned SHA) so