fix: add explicit permissions block to auto-assign

[baxyz]

Summary

• Same CodeQL finding as helpers4/.github#11: this repo's auto-assign.yml calls the reusable-auto-assign.yml reusable workflow without declaring an explicit permissions: block. typescript/website already have this correctly declared (issues: write, pull-requests: write); action/devcontainer didn't. Adding it here to match.

🤖 Generated with Claude Code

[github-actions]

✅ PR Validation Passed

All checks passed!

---

📋 Pipeline Status

	Job	Status
✅	🧾 Conventional Commits	passing
✅	🔖 Version Bump	passing
✅	🧪 Feature Tests	passing
✅	🐚 ShellCheck	passing

---

_{🤖 Generated by @helpers4 CI • 2026-07-29}