fix(automation): grant DiskSage scheduler OIDC permission

.github/workflows/disksage-hourly-review-repair.yml

@@ -16,6 +16,9 @@ permissions:
 
 jobs:
   dispatch-review-repair:
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/pr-review-fix-scheduler.yml
     with:
       target_repository: ContextualWisdomLab/disksage

tests/test_disksage_hourly_review_caller.py

@@ -34,7 +34,7 @@ def test_disksage_caller_preserves_credentials_and_read_only_token_scope() -> No
     workflow_scope, jobs_scope = caller.split("\njobs:\n", maxsplit=1)
 
     assert "\npermissions:\n  contents: read\n" in workflow_scope
-    assert "\n    permissions:\n" not in jobs_scope
+    assert "\n    permissions:\n      contents: read\n      id-token: write\n" in jobs_scope
     assert "PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}" in caller
     assert "OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}" in caller
     assert "secrets: inherit" not in caller

tests/test_hourly_scheduler_runtime_budget.py

@@ -32,6 +32,14 @@ def test_product_callers_do_not_cancel_an_in_flight_rca() -> None:
         assert "cancel-in-progress: true" not in caller
 
 
+def test_disksage_caller_grants_oidc_permission_to_reusable_scheduler() -> None:
+    """The called scheduler must be able to exchange its OpenCode OIDC token."""
+    caller = _read(DISKSAGE)
+    job = caller.split("  dispatch-review-repair:\n", maxsplit=1)[1]
+
+    assert "    permissions:\n      contents: read\n      id-token: write\n" in job
+
+
 def test_quality_gate_tracks_runtime_budget_contract() -> None:
     """Runtime-budget changes always execute the exact-head focused gate."""
     quality = _read(QUALITY)