fix(ci): hypatia-scan PR-comment must not gate the scan

Canonical adoption got the scanner running (Clone/Build/Run all ✓) but
the 'Comment on PR with findings' step hard-failed: github-script@v7
with the default GITHUB_TOKEN got 'Resource not accessible by
integration' — the permissions block had no pull-requests: write and
the step had no continue-on-error, despite the template's own design
note that this step 'must NEVER hard-fail the scan' (hypatia#213).

Two-part at-source fix (latent canonical-template gap):
- permissions: add pull-requests: write so the advisory comment posts
- Comment step: continue-on-error: true so a token/API hiccup or a
  fork PR (read-only token) skips the comment, never the check

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: tanush5800

.github/workflows/hypatia-scan.yml

@@ -25,6 +25,11 @@ permissions:
   # the rule silently returns no findings.
   # See 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
   security-events: read
+  # pull-requests: write lets the advisory "Comment on PR with findings"
+  # step post its summary. Without it the built-in GITHUB_TOKEN gets
+  # "Resource not accessible by integration" and (absent continue-on-error)
+  # hard-fails the scan — exactly what the gate-decoupling design forbids.
+  pull-requests: write
 
 jobs:
   scan:
@@ -211,6 +216,11 @@ jobs:
 
       - name: Comment on PR with findings
         if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0
+        # Advisory only — posting findings as a PR comment must never gate
+        # the scan (hypatia#213 gate decoupling). Belt-and-braces alongside
+        # the pull-requests: write permission above: a token/API hiccup or
+        # a fork PR (read-only token) skips the comment, not the check.
+        continue-on-error: true
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7
         with:
           script: |