ci: grant nightly call sites the permissions their workflows declare (#2532)

* ci: grant nightly call sites the permissions their workflows declare

The nightly family workflow had never started: a called workflow can only
narrow the caller's GITHUB_TOKEN, so any call site whose ceiling is below
what the called workflow declares fails the entire run at validation time,
before a single job is created (run 33689075661, startup_failure).

Six call sites were short:
- prepare/finalize-claw-server granted contents: write, but
  release-claw-server.yml declares publish-ota and reflect-version with
  pull-requests: write. Both are skipped here (publish_ota: false,
  state_owner: suite) but validation is static and runs before if:.
- build-browseros/build-browserclaw had no permissions block, so they
  inherited the workflow-level permissions: {} and granted nothing to
  nightly-macos-product.yml, which declares contents: read.
- server-ota/claw-server-ota granted contents: read to
  publish-server-ota.yml, which declares contents + pull-requests write
  to publish the feed snapshot and its reconciliation pull request.

Ceilings now match what release-browseros.yml and release-browserclaw.yml
already use for the same called workflows.

* ci: keep the nightly ceilings minimal

Narrows the previous commit to the only call sites that actually elevate.

Only job-level permissions inside a called workflow are validated against
the caller's ceiling; a callee's workflow-level block is a default for
standalone runs and is supplied by the caller when it is invoked through
workflow_call. release-claw-server.yml is the only callee here that
declares job-level permissions (publish-ota and reflect-version, both
pull-requests: write), so it is the only ceiling that had to widen.

Reverted as unnecessary:
- build-browseros/build-browserclaw: nightly-macos-product.yml declares no
  job-level permissions and never checks out or uses the token.
- server-ota/claw-server-ota: publish-server-ota.yml declares none either,
  and in suite mode the writes belong to reconcile-state, so contents: read
  is the correct least-privilege ceiling. ci_workflow_test asserts it.

Author: shadowfax92

.github/workflows/nightly.yml

@@ -101,6 +101,7 @@ jobs:
     uses: ./.github/workflows/release-claw-server.yml
     permissions:
       contents: write
+      pull-requests: write
     with:
       mode: build
       defer_finalize: true
@@ -228,6 +229,7 @@ jobs:
     uses: ./.github/workflows/release-claw-server.yml
     permissions:
       contents: write
+      pull-requests: write
     with:
       mode: finalize
       state_owner: suite