Grant actions: read so the gate can list its own workflow's jobs

fetchCurrentWorkflowCheckRunIds() calls GET /actions/runs/{run_id}/jobs
to map the current workflow run's jobs to their corresponding check-run
IDs, which is what lets waitForChecksToSettle() ignore its own check
run when deciding whether 'other' checks are pending.

Once a workflow declares an explicit permissions block, every scope
not listed defaults to 'none'. The block listed checks/contents/
pull-requests but omitted actions, so GITHUB_TOKEN would 403 against
the Actions Jobs API and the gate would error out before reaching its
fail-closed Anthropic decision.

Add 'actions: read' with an explanatory comment so the dependency is
documented at the permission site.

Co-authored-by: Jonathan Kingston <jonathanKingston@users.noreply.github.com>

Author: cursoragent

.github/workflows/dependabot-auto-merge.yml

@@ -5,6 +5,12 @@ on:
         types: [opened, reopened, synchronize, ready_for_review]
 
 permissions:
+    # `actions: read` is required so the gate script can call
+    # `GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs` to exclude its own
+    # workflow run from the wait set in `fetchCurrentWorkflowCheckRunIds()`.
+    # Once explicit permissions are set, anything not listed defaults to
+    # `none`, so omitting this would 403 before the gate ever runs.
+    actions: read
     checks: read
     contents: write
     pull-requests: write