ci: cover the permissions the nightly's build and OTA callees declare

The nightly still failed validation after the claw-server fix. Bisecting
with push-triggered copies of the workflow on a scratch branch localised
two more call sites; each was proven in isolation:

- build-browseros/build-browserclaw had no permissions block, so they
  inherited the workflow-level permissions: {} and granted nothing to
  nightly-macos-product.yml, which declares contents: read.
- server-ota/claw-server-ota granted contents: read to
  publish-server-ota.yml, which declares contents and pull-requests write.

A called workflow can only narrow the caller's GITHUB_TOKEN, and that is
checked statically for the whole nested tree before any job is created, so
a short ceiling rejects the entire run. With both covered, a full copy of
the workflow created all 17 jobs and stopped at the intended
'must run from refs/heads/main' guard.

ci_workflow_test asserted the contents: read ceiling that caused this, so
it encoded the bug; updated to the ceiling that actually validates.

Author: shadowfax92

.github/workflows/nightly.yml

@@ -182,6 +182,8 @@ jobs:
     name: Build signed BrowserOS nightly
     needs: [transaction, verify-components]
     uses: ./.github/workflows/nightly-macos-product.yml
+    permissions:
+      contents: read
     with:
       product: browseros
       state_ref: ${{ needs.transaction.outputs.state_ref }}
@@ -197,6 +199,8 @@ jobs:
     name: Build signed BrowserOS neo nightly
     needs: [transaction, verify-components]
     uses: ./.github/workflows/nightly-macos-product.yml
+    permissions:
+      contents: read
     with:
       product: browserclaw
       state_ref: ${{ needs.transaction.outputs.state_ref }}
@@ -275,7 +279,8 @@ jobs:
     needs: [transaction, finalize-server]
     uses: ./.github/workflows/publish-server-ota.yml
     permissions:
-      contents: read
+      contents: write
+      pull-requests: write
     with:
       product: browseros
       version: ${{ needs.transaction.outputs.server_version }}
@@ -289,7 +294,8 @@ jobs:
     needs: [transaction, finalize-claw-server]
     uses: ./.github/workflows/publish-server-ota.yml
     permissions:
-      contents: read
+      contents: write
+      pull-requests: write
     with:
       product: browserclaw
       version: ${{ needs.transaction.outputs.claw_server_version }}

packages/browseros/bos_build/ci_workflow_test.py

@@ -1687,7 +1687,14 @@ def test_public_finalization_and_state_merge_follow_both_builds(self):
             self.assertEqual(job["uses"], "./.github/workflows/publish-server-ota.yml")
             self.assertEqual(job["with"]["product"], product)
             self.assertEqual(job["with"]["state_owner"], "suite")
-            self.assertEqual(job["permissions"], {"contents": "read"})
+            # A called workflow can only narrow the caller's GITHUB_TOKEN, so the
+            # ceiling must cover what publish-server-ota.yml declares. Granting
+            # less rejects the whole run at validation time, before any job is
+            # created — see run 33689075661.
+            self.assertEqual(
+                job["permissions"],
+                {"contents": "write", "pull-requests": "write"},
+            )
 
         reconcile = jobs["reconcile-state"]
         self.assertTrue(set(finalizers).issubset(set(reconcile["needs"])))