cla-check workflow fails: CLA Assistant cannot write signatures to protected main

Summary

The cla-check GitHub Actions workflow (.github/workflows/cla.yml, using contributor-assistant/github-action) fails on PRs with:

Resource not accessible by integration
... the branch where signatures are stored ...
Committers ... have to sign the CLA

The action attempts to commit the CLA signature file to main, but main is protected (and/or the GITHUB_TOKEN lacks write permission to it), so the write is rejected.

Why this is not a code problem in any given PR

This is a repo/org configuration issue, not something an individual feature PR can fix. Notably, the separate license/cla GitHub App status check (microsoft-github-policy-service) passes on PRs, indicating contributors have in fact signed the CLA. The Actions-based cla-check is a redundant, misconfigured second mechanism.

Suggested remediation (pick one)

• Point the CLA Assistant action's signature storage at an unprotected branch (e.g. a dedicated cla-signatures branch), or
• Grant the workflow token write access to the signature location via a ruleset bypass / PAT, or
• Remove the redundant cla-check Actions workflow and rely solely on the passing license/cla GitHub App.

Evidence

• Observed on PR #20, job: https://github.com/microsoft/cates/actions/runs/27383522482/job/80925498279
• license/cla GitHub App check passes on the same PR.

This blocks merges that gate on cla-check until the configuration is corrected.