ci: grant unit-test workflow permission to comment on PRs

The Coverage report step (lucassabreu/comment-coverage-clover) creates a
comment on the pull request, which is a write operation. unit-test.yml
declared no permissions block, so the job received the repository default.

The job log for run 35718905177 records what the token actually held:

  GITHUB_TOKEN Permissions
  Contents: read
  Metadata: read
  Packages: read

All read, no write, so the POST to the issue-comments endpoint returned
403 "Resource not accessible by integration". Build, tests and the
dorny/test-reporter step all succeeded; only the coverage comment failed.

This affects every run since 2026-08-02, including on development and
master. The last successful run was 2026-07-29.

Declaring a permissions block sets unlisted scopes to none, so contents:
read is included for actions/checkout. checks: write is deliberately not
granted: the test-reporter step is currently succeeding without it.

Mirrors back-merge-pr.yml and sca-scan.yml, which already declare the same
two scopes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: cs-raj

.github/workflows/unit-test.yml

@@ -9,6 +9,9 @@ jobs:
   build-test:
     name: Build & Test
     runs-on: ubuntu-latest
+    permissions:
+      contents: read          # actions/checkout
+      pull-requests: write    # coverage report comments on the PR
     steps:
       - uses: actions/checkout@v2     # checkout the repo
       - uses: actions/setup-node@v3