ci(auto-merge): grant issues:write and merge before commenting

[cdhagmann]

Summary

Auto-merge of #68 (a fork PR) failed because the workflow's gh pr comment was denied (GraphQL: Resource not accessible by integration (addComment)). The workflow declared pull-requests: write but not issues: write, and gh pr comment posts via the GraphQL addComment mutation, which is enforced under the issues scope. set -euo pipefail then aborted the step before gh pr merge ran. This grants issues: write, reorders the step so merge runs before the celebratory comment, and makes that comment best-effort.

Linked issue / ADR

No issue — surfaced by the failed run on PR #68. No ADR: this is workflow plumbing, not an architectural change.

Working agreement

• Single concern (workflow permission + ordering fix; no unrelated changes)
• bin/rubocop and bin/rspec pass locally — N/A, workflow-only change with no Ruby diff
• New behavior has a test; bug fix has a regression test — N/A, GitHub Actions workflows aren't unit-tested in this repo; verification is end-to-end (see Test plan)
• Async work goes through Rooibos Commands — N/A, no Ruby code changed

Test plan

End-to-end: once this lands on main, the pull_request_target workflow re-runs against the base-branch version on the next synchronize event, so the fix applies retroactively to PR #68. Plan:

1. Merge this PR.
2. Close-and-reopen #68 (or push a no-op commit to Matt's branch) to retrigger validate-and-merge.
3. Expected: lint passes (✓ 2 entries, all valid was already green), then gh pr merge --squash --delete-branch succeeds, then the "🎉 Thanks…" comment posts.
4. If the comment regresses again, || true keeps the merge effective — check the run log for permission drift.

Notes for reviewer

• Considered flipping the repo-wide default_workflow_permissions from read to write, but per-workflow declarations are the more conservative path and match the rest of the repo.
• The same issues: write permission also benefits the if: failure() "validation failure" comment step in this workflow, which would have hit the same denial.

🤖 Generated with Claude Code

[github-actions]

✅ PR template check passed. Thanks for filling out the template.