fix: grant write permissions and use @main in claude workflow

[ashwin-ant]

Switch workflow permissions from read to write for contents, pull-requests, and issues so that the OIDC app token can push commits via git CLI.

Also points the workflow to @main instead of @v1.

[claude]

Nit: Since this is intentionally tracking main for dogfooding (rather than an oversight), a brief comment would help future contributors understand the intent and avoid "fixing" it back to a release tag:

Suggested change

	uses: anthropics/claude-code-action@main
	uses: anthropics/claude-code-action@main # dogfood latest changes

[claude]

Clean, well-motivated fix. The PR description does a good job explaining the root cause (actions/checkout includeIf config approach breaking the git config --unset-all credential cleanup) and why API commit signing is the right solution -- it sidesteps the git CLI credential issue entirely.

Summary:

• use_commit_signing: true -- net positive, both as a fix for the credential race and as a security improvement (signed commits).
• @main pinning -- reasonable for dogfooding your own action. Left a minor suggestion to add a comment clarifying the intent.

No concerns with performance, test coverage, or documentation. Looks good.