fix(ci): add pull-requests write permission to GitHub App token in pre-commit autoupdate workflow

[Copilot]

The pre-commit autoupdate workflow was failing with Resource not accessible by integration when peter-evans/create-pull-request attempted to open a PR. The GitHub App token was scoped to permission-contents: write only — pull-requests: write was missing, so the API call to create the PR was rejected.

Summary

• Added permission-pull-requests: write to the actions/create-github-app-token step so the generated token carries the required permission for PR creation.

- name: Create release App token
  id: release-token
  uses: actions/create-github-app-token@... # v2
  with:
    app-id: ${{ vars.RELEASE_APP_ID }}
    private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
    permission-contents: write
    permission-pull-requests: write   # added

Validation

• just check (or equivalent targeted checks) was run successfully
• Relevant unit/integration tests were added or updated
• Examples, fixtures, screenshots, and logs use synthetic data and contain no credentials or personally identifiable information

Tax Logic Review Checklist

• For tax-calculation numeric assertions, expected values come from IRS/SSA-backed fixtures or are explicitly derived from loaded tax models (not opaque literals)
• Any intentionally synthetic numeric test data is labeled with a short rationale
• Tax data or behavior changes are reflected in docs (README.md and/or docs/)
• Authoritative IRS/SSA sources are linked for tax-data or calculation changes

Risk and Impact

CI-only change. No production code, tax logic, or user-facing behavior affected. Restores the automated weekly pre-commit hook update workflow.

[railway-app]

🚅 Deployed to the tax-tracker-pr-88 environment in endearing-eagerness

Service	Status	Web	Updated (UTC)
tax-tracker	⏭️ Skipped (View Logs)	Web	Aug 2, 2026 at 2:50 pm

[Copilot]

Pull request overview

Updates the pre-commit autoupdate GitHub Actions workflow so the GitHub App token used by peter-evans/create-pull-request has sufficient permissions to open a pull request, resolving Resource not accessible by integration failures in the automation.

Changes:

• Added permission-pull-requests: write to the actions/create-github-app-token step so the generated GitHub App token can create PRs.