fix(ci): add id-token:write to staging-ci parent workflow [skip-regression-check]

Called workflows inherit permissions from the parent. claude-review.yml
needs id-token:write for OIDC, so the parent staging-ci.yml must also
declare it.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

.github/workflows/staging-ci.yml

@@ -18,6 +18,7 @@ permissions:
   contents: write
   issues: write                    # Claude review creates issues for critical findings
   pull-requests: write             # Auto-promote creates + merges PR to main
+  id-token: write                  # Required by claude-code-action for OIDC auth
 
 concurrency:
   group: staging-ci