fix(ci): add id-token: write so claude-review can mint its GitHub token (#700)

claude-code-action@v1 fetches an OIDC token to mint its GitHub token for
posting review comments; without id-token: write it failed with
'Could not fetch an OIDC token'. Surfaced by the first live PR (#699):
auto-approve worked, but the genuine review never posted.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: blove

.github/workflows/claude-review.yml

@@ -19,6 +19,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      id-token: write # claude-code-action mints its GitHub token via OIDC
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2