How to get permissions working for triggers via non-maintainers?

For example, I'm trying to set up automated claude code reviews.
I've tried `pull_request` and `pull_request_target` triggers.

I've also tried the default GITHUB_TOKEN with setting up write permissions in the workflow file, and also now defined my own PAT token.

However the Claude Code action always fails with:

```
Run bun run ${GITHUB_ACTION_PATH}/src/entrypoints/prepare.ts
Auto-detected mode: agent for event: pull_request
Using provided GITHUB_TOKEN for authentication
Checking permissions for actor: {{AUTHOR}}
Permission level retrieved: read
Warning: Actor has insufficient permissions: read
Error: Prepare step failed with error: Actor does not have write permissions to the repository
Error: Process completed with exit code 1.
```

Example here: https://github.com/thomhurst/TUnit/actions/runs/20957471946/job/60225577738?pr=4360