fix: surface pull-requests permission failure instead of silently exiting 0

[qozle]

Problem

Two compounding bugs that result in the code review action running successfully but silently posting no output anywhere — green check, zero comments, no indication anything went wrong.

Bug 1: Example workflows have wrong permissions

examples/pr-review-filtered-authors.yml and examples/pr-review-filtered-paths.yml both specify:

permissions:
  pull-requests: read   # ← wrong

Posting review comments requires pull-requests: write. Users copying these templates hit silent failures with no diagnostic.

Bug 2: Action exits 0 when Claude can't post comments (403)

When Claude calls create_inline_comment and receives a 403, the MCP server already returns { isError: true }. But Claude still concludes subtype: "success" because from its perspective it "attempted the task." The action trusts subtype as the sole success signal:

const isSuccess = resultMessage.subtype === "success";
result.conclusion = isSuccess ? "success" : "failure";

Result: green check, zero review comments, no feedback.

Fix

Bug 1: Change pull-requests: read → write in both example files.

Bug 2 — two-part fix:

Part A — add a 403-specific helpMessage to github-inline-comment-server.ts so Claude's response includes actionable guidance:

This error means the workflow token lacks permission to post review comments. Add pull-requests: write to your workflow's permissions block.

Part B — after runClaude() returns "success", scan the execution file for tool_result items with is_error: true and the text "Resource not accessible by integration" (GitHub's canonical error for this permission class). If any are found, override the conclusion to failure with an actionable message:

Claude attempted to post 5 review comment(s) but received a GitHub permission error.
Add `pull-requests: write` to your workflow's permissions block:

  permissions:
    pull-requests: write

The string "Resource not accessible by integration" is unambiguous — it's the specific Octokit error for GitHub Apps integration permission failures, not a general 403. The scan is a no-op when the execution file is absent or contains no such errors.

Fixes #1121