Coder cannot push workflow changes (missing workflows permission)

Summary

The Fullsend coder GitHub App cannot push commits that modify files under .github/workflows/. The agent can implement and validate the change successfully, but the post-script fails while publishing the branch, so no PR is created.

This blocks coder work on issues whose implementation necessarily changes a GitHub Actions workflow.

Evidence

Coder run 29496296106 for rhdh-plugin-export-overlays#1469:

• the agent exited with code 0
• output schema validation and secret scanning passed
• the agent created commit 4a57813f
• the commit changed .github/workflows/auto-publish-pr.yaml
• neither the remote branch nor a PR was created

Both the normal push and the --force-with-lease retry were rejected:

refusing to allow a GitHub App to create or update workflow
`.github/workflows/auto-publish-pr.yaml` without `workflows` permission

The post-script labels the first push failure as non-fast-forward and retries, although the rejection is permission-related.

Root cause

The push token minted for fullsend-ai-coder comes from a GitHub App installation that does not have permission to create or update Actions workflow files.

Expected

The coder publication path should support authorized workflow changes, or detect this limitation before spending an agent run implementing a change that cannot be published.

Acceptance criteria

• Determine where the coder App's workflow permission is configured and whether granting write access is acceptable.
• A coder run can push a branch containing an authorized .github/workflows/** change and create a PR.
• If workflow writes remain intentionally prohibited, Fullsend fails early with an actionable message and preserves or exposes the generated patch for a maintainer.
• The post-script does not describe permission rejections as non-fast-forward failures or retry them with --force-with-lease.

Start by locating where the Fullsend coder GitHub App installation permissions are configured and where the publication post-script handles pushes. Reproduce the failure using the cited coder run and the .github/workflows/auto-publish-pr.yaml change, then verify that authorized workflow changes publish successfully or that prohibited changes fail early with the generated patch preserved and permission errors are not retried as non-fast-forward failures.