docs: fix inaccurate compile-time permissions.write validation claim in debug prompt

prompts/debug-ado-agentic-workflow.md

@@ -416,7 +416,7 @@ this action. Details: identity 'Build\<guid>', scope '<scope>'.
 - **ARM service connection not authorized**: The pipeline needs explicit authorization for the service connection. Go to the pipeline's settings in ADO and authorize the service connection.
 - **Token scope insufficient**: The ARM service connection may not have the required permissions on the ADO project. Verify the connection's role assignments.
 - **Cross-project failure (`VS800075`)**: The pipeline is trying to act on a resource in a different project than where it runs and "Limit job authorization scope to current project" is ON. Either turn the toggle off (broader scope) or use a write service connection whose identity has explicit rights in the target project.
-- **Compile-time validation**: The compiler should catch missing `permissions.write` when write-requiring safe outputs are configured. If you're seeing this at runtime, the front matter may have been edited without recompiling.
+- **No compile-time error for missing `permissions.write`**: The compiler does **not** require `permissions.write` for write-bearing safe outputs — it emits a valid pipeline regardless, using `$(System.AccessToken)` as the default write token. Permission failures are purely a runtime concern. There is no "recompile to fix this" path; the fix is granting the right permission to the build identity or setting `permissions.write` to an ARM service connection with sufficient rights.
 
 **Diagnosis hint when reporting**: include the full `TF401027` line (with `<PermissionName>` and the `Build\<guid>` value), the failing safe-output `name`, the target repo / PR / work item id, and — if you have it — whether the build identity has an explicit Deny vs missing Allow on the target. The [`safe-output-permissions.md`](../docs/safe-output-permissions.md) reference page has the REST recipe to pull this in one curl.