Specifying id-token: write alone zeroes out all other default permissions,
including contents:read that actions/checkout needs -- this made the repo
appear as 'not found' to the workflow's own token on this private repo.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>