fix(ci): add explicit github_token for pull_request_target

The OIDC token exchange fails with pull_request_target events.
Provide explicit github_token to fix authentication.
Also upgrade to pull-requests: write for posting comments.

.github/workflows/claude-code-review.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: read
+      pull-requests: write  # Needed to post review comments
       issues: read
       id-token: write
 
@@ -55,6 +55,8 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Explicit github_token needed for pull_request_target (OIDC doesn't work)
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           prompt: |
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ github.event.pull_request.number }}