Update claude-security-review.yml

Signed-off-by: Adam Poulemanos <89049923+bashandbone@users.noreply.github.com>

Author: bashandbone

.github/workflows/claude-security-review.yml

@@ -46,6 +46,9 @@ on:
       CLAUDE_CODE_OAUTH_TOKEN:
         description: 'Org subscription OAuth token for Claude Code'
         required: true
+      GITHUB_TOKEN:
+        description: "Token for the caller's repo"
+        required: true
 
 # Layer 2: the workflow GITHUB_TOKEN stays read-only. All writes go through the
 # down-scoped App token minted below, which is what makes comments post as
@@ -80,12 +83,15 @@ jobs:
       - name: Mint down-scoped app token
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN || github.token }}
         with:
           client-id: ${{ secrets.KNITLI_AGENT_CLIENT_ID }}
           private-key: ${{ secrets.KNITLI_AGENT_PRIVATE_KEY }}
           permission-pull-requests: write
           permission-contents: read
           permission-checks: read
+          permission:actions: read
           permission-security-events: read
 
       # Layer 3: pin Claude to inline review comments + read-only gh PR commands.