fix: grant write permissions to OpenSpec caller workflow

[jamubc]

Why

The OpenSpec caller added in the previous PR ends in startup_failure: the reusable validator requests issues and pull-requests write, but the caller token grants none by default.

What Changes

• Add a permissions block granting issues and pull-requests write to the caller workflow

MODIFIED Requirements

Requirement: OpenSpec body validation

The OpenSpec workflow SHALL run to completion on issue and PR events. The caller MUST grant issues: write and pull-requests: write so the validator can label and comment.
(Previously: every run ended in startup_failure because the callee requested permissions the caller did not grant.)

Scenario

GIVEN this fix is merged to the default branch
WHEN an issue is opened or edited with a body missing OpenSpec sections
THEN the OpenSpec run completes, fails the check, applies needs-info, and comments

Verification

• 1.1 Edit an issue missing sections and confirm the run completes with a needs-info label and comment
• 1.2 Confirm no startup_failure appears in the Actions log