fix: add pull-requests: write to post-run-link job

[ralphbean]

Summary

• The post-run-link job only had issues: write permission, which is insufficient for commenting on pull requests
• PR-triggered events (via pull_request_target) caused GraphQL: Resource not accessible by integration (addComment) errors
• Adds pull-requests: write to match what dispatch-stop-fix already does correctly

Fixes the failure seen on #697.

Test plan

• Verify post-run-link succeeds on next PR event (e.g. re-trigger on Add CLI commands for repository enrollment management #697)

🤖 Generated with Claude Code

[github-actions]

Site preview

Preview: https://6704f755-site.fullsend-ai.workers.dev

Commit: e915f4b91ca6f497d96ef1dadcb3a0cdda8e9557

[fullsend-ai-review]

Review: #724

Head SHA: e915f4b
Timestamp: 2026-05-07T00:00:00Z
Outcome: approve

Summary

This is a correct, minimal fix. The post-run-link job uses gh issue comment with ${{ github.token }} to post run-link comments. When the triggering event is pull_request_target, the GitHub API requires pull-requests: write to comment on PRs — issues: write alone is insufficient. The sibling job dispatch-stop-fix (line 418) already carries both issues: write and pull-requests: write, confirming this is a known pattern in the workflow. The single-line addition grants the minimum permission needed to fix the GraphQL: Resource not accessible by integration (addComment) error observed on #697, with no security or correctness concerns.

Findings

No findings.

Footer

Outcome: approve
This review applies to SHA e915f4b91ca6f497d96ef1dadcb3a0cdda8e9557. Any push to the PR head clears this review and requires a new evaluation.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/fullsend.yaml