updated GHA with new checks:write permission

[derekmisler]

adds checks: write so the review agent can create a "PR Review" check run on PRs

[docker-agent]

Review Summary

Assessment: 🟢 APPROVE

This PR updates the GitHub Actions workflow to move permissions from the workflow level to the job level, following GitHub Actions security best practices (principle of least privilege). The changes add a new checks: write permission at the job level.

Changes analyzed:

• Removed workflow-level permissions (contents, pull-requests, issues)
• Added job-level permissions with the same permissions plus checks: write

Findings: No critical or notable issues found in the changed code.

The YAML syntax is correct, and the permission restructuring is a positive security improvement. The new checks: write permission allows the reusable workflow to create and manage check runs via the GitHub Checks API, which appears to be the intended functionality based on the PR title.

✅ Ready to merge (human approval recommended)