Enable "Allow GitHub Actions to create and approve pull requests" for the nightly refresh PR flow

[Kosinkadink]

The nightly refresh workflow (after #13) opens its manifest-sync PR with the built-in GITHUB_TOKEN via gh pr create. That call is currently blocked because the repository setting Allow GitHub Actions to create and approve pull requests is disabled (API: can_approve_pull_request_reviews=false). Every scheduled run will fail at the PR-creation step until this is enabled.

What to do:

1. Repo Settings -> Actions -> General -> Workflow permissions -> check Allow GitHub Actions to create and approve pull requests -> Save.
2. If the checkbox is greyed out, it is disabled at the Comfy-Org organization level; an org admin must enable the same setting under org Settings -> Actions -> General first, then re-check the repo setting.

Notes:

• default_workflow_permissions=read does NOT need changing: the workflow declares explicit permissions: contents: write, pull-requests: write, which override the default.
• R2 publishing is unaffected either way: the manifest is validated and uploaded to R2 in the same run before the PR step, and the desktop reads R2, not the repo. Until fixed, only the main-branch sync PR fails.
• Fallback if we do not want to grant this to Actions: store a PAT or GitHub App token as a repo secret and use it for the gh pr create step instead of GITHUB_TOKEN.

[coderabbitai]

🔗 Related PRs

#13 - ci: open a PR from the nightly refresh instead of pushing to protected main [open]

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!