fix(ci): grant Lighthouse workflow pull-request write permission

Dependabot PRs get a read-only GITHUB_TOKEN by default, so the
`Format Lighthouse results as PR comment` step (using github-script
to call createComment) was failing with `Resource not accessible by
integration`. deploy.yml already declared the needed permission;
lighthouse.yml was missing it, making this step the last hop blocking
Dependabot PRs from going green.

Also add continue-on-error to the comment step — the Lighthouse score
artifact is the primary output; losing the pretty PR summary should
not tank the workflow conclusion.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: beihaili

.github/workflows/lighthouse.yml

@@ -7,6 +7,12 @@ on:
 jobs:
   lighthouse:
     runs-on: ubuntu-latest
+    # Needed by the `Format Lighthouse results as PR comment` step below.
+    # Without this, Dependabot PRs get a read-only GITHUB_TOKEN and the
+    # comment call fails with `Resource not accessible by integration`.
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v6
 
@@ -40,6 +46,9 @@ jobs:
 
       - name: Format Lighthouse results as PR comment
         if: always()
+        # Posting the comment is a nice-to-have summary; if token perms
+        # are ever tightened again, don't fail the whole workflow.
+        continue-on-error: true
         uses: actions/github-script@v8
         with:
           script: |