[callumreid]

• Give the weekly parity job pull-requests: write so it can comment on an existing hand-reconciled rolling PR. Retain read-only repository contents and the existing issue-reporting permission.
• The November 2 run preserved [COVAL-5819] feat: add Python metric draft commands and audit request fields #141 correctly, then failed with HTTP 403 when posting its guard comment: https://github.com/coval-ai/cli/actions/runs/41425914844. No branch reset, credential change, or broader contents access is introduced.
• Validation: actionlint and all 63 existing automation tests pass. Actual scheduled-workflow recovery remains to be verified after this change merges; no generator rerun or hand-branch mutation was used for validation.

[borgesius]

Looks good. This supplies the pull-request comment permission missing in the recorded failure while preserving read-only contents access and the hand-commit branch guard.