fix: grant id-token for dd-triage

[egdbear]

This PR adds fix for oidc token generation.

Follow-up to #111

[claude]

Summary

Adds id-token: write to the triage job in daily-datadog-triage.yml. claude-code-action@v1 requests an OIDC token on startup even when authenticated with an API key, so the run failed before reaching the prompt without this permission.

Issues Found

None.

The change is correct and matches the established pattern in this repo. claude-review.yml also runs anthropics/claude-code-action@v1 with anthropic_api_key and grants id-token: write (line 166), confirming the action needs this scope regardless of API-key auth. The inline comment explains the why clearly.

The scope stays minimal: contents: read plus id-token: write. id-token: write only lets the job mint an OIDC token; it does not grant repo write access, and issue writes still come from triage-issues-token rather than GITHUB_TOKEN, so the escalation guarantee noted at lines 49-50 holds.

Areas Reviewed

• Security: No new exposure. id-token: write is low-risk and required by the action.
• Correctness: Fix addresses a real startup failure, verified against the working sibling workflow.

Looks good to merge.