Mirrors OpenIPC/firmware#2133. Today's scheduled cleanup run failed with HTTP 403: Resource not accessible by integration when dispatching manifest.yml — the prune job only declared contents:write. The refresh step also fires on the empty-prune path (exit 0 only exits the step, not the job), which is wasted work since manifest.yml is already kept fresh by master.yml's workflow_run. Add actions:write to the permissions block, and gate the refresh on a step output so it runs only after an actual deletion. Co-authored-by: John <zekccsripfwrocp-15689@yn.furvionx.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>