ci(ai-validation): restore id-token: write (claude-code-action@v1 uses OIDC)

Revert of the id-token drop from #1969. Smoke verify on PR #1977
(empty-commit retrigger run 25658256103) failed at the Pass 2 step:

  Action failed with error: Could not fetch an OIDC token. Did you
  remember to add `id-token: write` to your workflow permissions?

The earlier Copilot finding that motivated dropping the permission
("no step uses OIDC") was incomplete. No shell step in the workflow
invokes OIDC directly, but anthropics/claude-code-action@v1 itself
calls actions/core's `getIDToken()` internally — likely for the
Claude/Anthropic auth federation path. The required scope is the
third-party action's, not the workflow body's.

Adding id-token: write back with an inline comment block citing the
specific failure mode + the run ID where it was reproduced so this
isn't re-dropped on a future review pass.

Mirrored byte-identically across rolling/circinus/sagitta + canonical.

0 files changed, 0 insertions, 0 deletions