docs: clarify fine-grained PAT requirements for organization-owned Projects v2

[Copilot]

Organization-owned Projects v2 with fine-grained PATs require explicit permissions that weren't clearly documented. This caused confusion about which permissions are needed for both the GitHub MCP toolset and the update-project safe output.

Changes

projectops.md

• Expanded organization-owned projects section with granular permission requirements:
  • Repository permissions: Contents: Read, Issues: Read, Pull requests: Read (as needed)
  • Organization permissions: Projects: Read & Write
• Added "Organization-Owned Project Configuration" section with complete example showing both tools.github and safe-outputs.update-project configuration

tokens.md

• Enhanced fine-grained PAT setup (Option B) with detailed permission breakdown
• Added Option 3: complete organization project + GitHub tools integration pattern
• Clarified that organization access must be explicitly granted during token creation

Configuration Pattern

tools:
  github:
    toolsets: [default, projects]
    github-token: ${{ secrets.ORG_PROJECT_WRITE }}

safe-outputs:
  update-project:
    github-token: ${{ secrets.ORG_PROJECT_WRITE }}

The token requires:

• Repository access to specific repos with Contents: Read, Issues: Read, Pull requests: Read
• Organization permission: Projects: Read & Write

Original prompt

Update ProjectOps documentation for organization-owned projects to use a fine-grained one that has repository access with the following permissions:
Organizations > Project: Read & Write
Repositories > Contents: Read, (Issues: Read, Pull requests: Read as needed).
Workflows need the following with the PAT being as described above:

tools:
github:
toolsets: [default, projects]
github-token: ${{ secrets.ORG_PROJECT_WRITE }}

safe-outputs:
update-project:
github-token: ${{ secrets.ORG_PROJECT_WRITE }}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.