fix: grant id-token: write for claude-code-action OAuth flow

A manual AI fix sweep failed with "Could not fetch an OIDC token. Did you
remember to add id-token: write to your workflow permissions?". The action
mints a GitHub OIDC token to authenticate the claude_code_oauth_token flow,
which needs id-token: write — absent from both jobs' permissions. Tier 2
failed on it now; tier 1 would have failed identically the first time it
ran live. Added to both.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/daily_ai_fix.yaml

@@ -33,6 +33,7 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  id-token: write  # claude-code-action fetches a GitHub OIDC token to auth the OAuth flow
 
 concurrency:
   group: ai-fix-sweep

.github/workflows/on_issues_ai_triage.yaml

@@ -17,6 +17,7 @@ on:
 permissions:
   contents: read
   issues: write
+  id-token: write  # claude-code-action fetches a GitHub OIDC token to auth the OAuth flow
 
 concurrency:
   group: ai-triage-${{ github.event.issue.number }}