Add permissions block to example caller workflow to satisfy CodeQL

[twistedmelonman]

Non-Blocking Review Concern: Add permissions block to example caller workflow to satisfy CodeQL

Source: github-advanced-security[bot]
Location: .github/workflows/claude-code-review.yml:36
PR: #17 — feat(blocking-review): add cost guards and scope constraints (#17)
Merged: 2026-03-20

What was flagged

CodeQL flagged that the workflow lacks a permissions block. However, looking at the diff, the new version of claude-code-review.yml actually does have a top-level permissions block (contents:read, pull-requests:write, issues:write, id-token:write) added at line 15. The CodeQL alert at line 36 likely refers to the old file state or a stale scan. Verify the CodeQL alert auto-closes after merge; if it persists, dismiss it as resolved.

Context

This issue was automatically created from a non-blocking concern identified
during pre-merge review of PR #17. It was safe to merge but worth tracking.

---

Created by pre-merge-review.sh

[twistedmelonman]

Resolved in PR #41. The original example caller (.github/workflows/claude-code-review.yml) was replaced with .github/workflows/self-review.yml, which declares permissions: at the top level (contents: read, pull-requests: write, issues: write, id-token: write) — matching what the reusable workflow's permission-verification step requires.