docs: trim workflows:write comments

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: tommasini

.github/workflows/create-release-pr.yml

@@ -109,11 +109,8 @@ jobs:
       # - contents: write       → push the release / version-bump / changelog branches
       # - pull_requests: write  → open the release PRs
       # - members: read         → auto-changelog --autoCategorize resolves PR author teams (read:org)
-      # - workflows: write      → this job cuts the release branch/PR itself from main, which can
-      #                           genuinely carry .github/workflows/* differences relative to the
-      #                           previous release branch (workflow files evolve on main between
-      #                           release cuts). This is a real need, not just a timeout workaround
-      #                           (contrast with update-release-changelog.yml).
+      # - workflows: write      → the release branch cut here comes from main and can genuinely
+      #                           differ in .github/workflows/* from the previous release branch
       # OIDC works on every trigger, so no workflow_dispatch vs workflow_call token split is needed.
       - name: Get token
         id: get-token

.github/workflows/update-release-changelog.yml

@@ -57,13 +57,9 @@ jobs:
       # Mint a short-lived token via the token-exchange service (OIDC). It needs:
       # - contents: write       → push the changelog branch
       # - pull_requests: write  → open/update the changelog PR
-      # - workflows: write      → this step only ever pushes CHANGELOG.md, so no real workflow
-      #                           file diff is expected here. We only need this permission due
-      #                           to a GitHub API timeout bug: GitHub's push-protection check
-      #                           still has to determine on every push whether workflow files
-      #                           changed, and that check has been timing out and rejecting the
-      #                           push outright (same bug class as actions/checkout#2287).
-      #                           Holding the scope up front avoids the check entirely.
+      # - workflows: write      → workaround for a GitHub push-protection timeout bug on new
+      #                           branch pushes (see actions/checkout#2287); this step never
+      #                           actually touches workflow files.
       - name: Get token
         id: get-token
         uses: MetaMask/github-tools/.github/actions/get-token@v1