ci: allow git push in bot-write-docs allowlist (#2537)

The first end-to-end run of the docs-request path on issue #2536
([#25619794274](https://github.com/wheels-dev/wheels/actions/runs/25619794274))
revealed that bot-write-docs's allowlist scoped git too narrowly:
specific subcommands (status, log, diff, show, grep, add, commit) but
not push. The bot wrote the docs, committed them, then attempted
`gh pr create` — which needs the branch on remote, but the bot couldn't
push it. The workflow's "Push branch" step ran AFTER the bot finished,
pushing too late for the bot's `gh pr create` call.

Result: the docs/bot-2536-* branch landed on origin with full content,
but no PR was opened. The bot caught this in its issue comment and
explained the situation correctly ("the workflow's push step will
publish the branch after this run; once it is on the remote, the
draft PR can be opened from that branch") — high-quality failure
reporting, but the cascade stopped there.

Add `Bash(git push:*)` to the allowlist. The wheels-bot push-scope
ruleset (16174270) restricts WHERE the bot can push to bot/**,
fix/bot-*/**, and docs/bot-*/**, so granting push capability does
not expand the bot's blast radius — it just lets the bot execute
the push the ruleset will permit anyway. Mirrors propose-fix's
`Bash(git:*)` wildcard (which has been working since #2533).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bpamiri

.github/workflows/bot-write-docs.yml

@@ -101,7 +101,7 @@ jobs:
           claude_args: |
             --model claude-sonnet-4-6
             --max-turns 30
-            --allowedTools "Bash(gh:*),Bash(git status),Bash(git log:*),Bash(git diff:*),Bash(git show:*),Bash(git grep:*),Bash(git add:*),Bash(git commit:*),Read,Edit,Write,Grep,Glob"
+            --allowedTools "Bash(gh:*),Bash(git status),Bash(git log:*),Bash(git diff:*),Bash(git show:*),Bash(git grep:*),Bash(git add:*),Bash(git commit:*),Bash(git push:*),Read,Edit,Write,Grep,Glob"
 
       - name: Push branch
         if: steps.gate.outputs.skip == 'false'