docs(agent-skills): add missing GitHub Actions permissions for component updater

The workflow example and token guidance omitted contents: write and
pull-requests: write, required under GitHub's read-only default
permissions for atmos vendor update --pull-request, and didn't
document id-token: write for the github/sts OIDC exchange.

Addresses CodeRabbit review comment on PR #2756.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: osterman

agent-skills/skills/atmos-migration/references/from-component-updater.md

@@ -6,6 +6,9 @@ Replace the legacy updater action with a scheduled workflow that checks out the
 jobs:
   vendor-update:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     container:
       image: ghcr.io/cloudposse/atmos:${{ vars.ATMOS_VERSION }}
     steps:
@@ -30,6 +33,6 @@ Do not retain a third-party action for updating, committing, pushing, or opening
 | GitHub token input | `ATMOS_CI_GITHUB_TOKEN`, `ATMOS_PRO_GITHUB_TOKEN`, `GITHUB_TOKEN`, or `GH_TOKEN` |
 | action summary | Native GitHub step summary |
 
-Stage the rollout: first run `atmos vendor update --check --group <name>` on a non-production group; then enable `--pull-request` manually; finally schedule it and retire the legacy action. Grant only `contents: write`, `pull-requests: write`, and `issues: write` where labels/assignees are used. The default `GITHUB_TOKEN` suppresses downstream push workflows; instead of a long-lived PAT or manually-managed GitHub App token, pair the Component Updater with the `github/sts` auth integration: `atmos auth exec --identity <github-sts-identity> -- atmos vendor update --pull-request` mints a real GitHub App installation token and exports it as `ATMOS_PRO_GITHUB_TOKEN`, which the Component Updater already prefers over `GITHUB_TOKEN`.
+Stage the rollout: first run `atmos vendor update --check --group <name>` on a non-production group; then enable `--pull-request` manually; finally schedule it and retire the legacy action. Grant only `contents: write` and `pull-requests: write`; add `issues: write` only when using labels or assignees. The default `GITHUB_TOKEN` suppresses downstream push workflows; instead of a long-lived PAT or manually-managed GitHub App token, pair the Component Updater with the `github/sts` auth integration, whose job needs `id-token: write` for the OIDC exchange: `atmos auth exec --identity <github-sts-identity> -- atmos vendor update --pull-request` mints a real GitHub App installation token and exports it as `ATMOS_PRO_GITHUB_TOKEN`, which the Component Updater already prefers over `GITHUB_TOKEN`.
 
 See the vendoring [Component Updater reference](../../atmos-vendoring/references/component-updater.md) for the native operating model.

agent-skills/skills/atmos-vendoring/references/component-updater.md

@@ -6,6 +6,6 @@ Configure source selection under `vendor.update`. A group has `include` and opti
 
 Put PR behavior under `vendor.ci.pull_request`: `provider: github`, optional `base_branch`, `branch_prefix`, title/body templates, labels, draft, reviewers, and assignees. Branches are deterministic and never force-pushed. Atmos discovers updates before branch creation, so no update makes no branch, commit, push, or PR. `--pull-request` implies `--pull`; `--check` never writes.
 
-Supply `ATMOS_CI_GITHUB_TOKEN`, `ATMOS_PRO_GITHUB_TOKEN`, `GITHUB_TOKEN`, or `GH_TOKEN`, in that precedence order. Use `contents: write`, `pull-requests: write`, and `issues: write` as needed. A default `GITHUB_TOKEN` does not trigger downstream push/pull_request workflows; pair the Component Updater with the `github/sts` auth integration for a token that does — `atmos auth exec --identity <github-sts-identity> -- atmos vendor update --pull-request` mints a real GitHub App installation token and exports it as `ATMOS_PRO_GITHUB_TOKEN`, which the Component Updater already prefers over `GITHUB_TOKEN`.
+Supply `ATMOS_CI_GITHUB_TOKEN`, `ATMOS_PRO_GITHUB_TOKEN`, `GITHUB_TOKEN`, or `GH_TOKEN`, in that precedence order. Grant the job `contents: write` and `pull-requests: write`; add `issues: write` only when using labels or assignees. A default `GITHUB_TOKEN` does not trigger downstream push/pull_request workflows; pair the Component Updater with the `github/sts` auth integration for a token that does — its job needs `id-token: write` for the OIDC exchange. `atmos auth exec --identity <github-sts-identity> -- atmos vendor update --pull-request` mints a real GitHub App installation token and exports it as `ATMOS_PRO_GITHUB_TOKEN`, which the Component Updater already prefers over `GITHUB_TOKEN`.
 
 GitHub Actions gets a Component Updater step summary on every vendor-update invocation when `GITHUB_STEP_SUMMARY` is available. It includes any PR link. Set `vendor.ci.summary.enabled: false` only when summaries must be suppressed. See `docs/prd/component-updater.md` for the full contract.