[ci-maintainer] Refresh community profiles fails weekly: repo blocks GITHUB_TOKEN from creating PRs

## CI Issue

The weekly `Refresh community profiles` workflow fails at the final `peter-evans/create-pull-request@v7` step:

```
##[error]GitHub Actions is not permitted to create or approve pull requests.
```

The workflow already declares `pull-requests: write`, so the blocker is the repo-level setting: **Settings → Actions → General → Workflow permissions → "Allow GitHub Actions to create and approve pull requests"** is disabled.

## Evidence

- Run [30782838316](https://github.com/castrojo/endusers/actions/runs/30782838316) (2026-08-03, schedule) — all steps succeed until create-pull-request.
- Run 30235746955 (2026-07-27) — same failure. The workflow has no successful run on record (2/2 failures).
- **Also affects** `import-architectures.yml`: it uses the same create-pull-request action and will hit this same wall once PR #49 (rsvg-convert) unblocks its validation step.

## Recommendation

A repo admin enables **Settings → Actions → General → Workflow permissions → "Allow GitHub Actions to create and approve pull requests"**. No workflow change needed — both workflows already request `pull-requests: write`. (Not fixable from a workflow PR; the setting is repo-level and the hive App lacks admin access to flip it.)

---
*Filed by ci-maintainer agent (ACMM L6 — full mode)*

Inspect the weekly Refresh community profiles workflow and import-architectures.yml, focusing on their pull-requests: write permissions and create-pull-request steps. Ask a repository admin to enable the specified Actions setting, then confirm a scheduled run can create its pull request successfully.

Written by the indexing model from the issue text.