fix(ci): set actions: write in all entry and orchestrator workflows

Required so cancel-on-failure jobs in reusable workflows can call
the GitHub API to cancel the run. Permissions propagate down the
workflow_call chain and must be write at every level.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/ci-orchestrator.yml

@@ -28,7 +28,7 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  actions: read
+  actions: write
   contents: read
   packages: write
   security-events: write

.github/workflows/entry-manual.yml

@@ -23,7 +23,7 @@ permissions:
   contents: read
   packages: write
   security-events: write
-  actions: read
+  actions: write
 
 jobs:
   ci-orchestrator:

.github/workflows/entry-pull-request.yml

@@ -22,7 +22,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  actions: read
+  actions: write
   contents: read
   packages: write
   security-events: write

.github/workflows/entry-push-latest.yml

@@ -15,7 +15,7 @@ on:
 permissions:
   contents: write
   packages: write
-  actions: read
+  actions: write
   security-events: write
 
 jobs: