claw-sarif fails every pull request: it mints the App token before it looks for a changed .t27, and the installation lacks security_events: write #10501

Goal

claw-sarif in .github/workflows/gate-topology.yml is red on every pull request, including PRs that change no .t27 file (#10500 changes only Markdown). The tok step (actions/create-github-app-token, permission-security-events: write) runs whenever CLAW_APP_ID and CLAW_APP_PRIVATE_KEY are set, before the step that lists changed .t27 files, and the App installation was never granted security_events: write: the log reads "The permissions requested are not granted to this installation". docs/claw/README.md promises the opposite: "without them the job uploads nothing and says so in its step summary". Seen on #10475, #10484, #10485, #10493, #10500.

Boundary

• .github/workflows/gate-topology.yml, job claw-sarif (owner-only gate file): list changed .t27 first and skip the token when there are none; when the token cannot be minted, write the step summary and exit 0, as the README says.
• Owner step, outside the repo: grant security_events: write to the TRI CLAW App and accept it on the gHashTag installation (docs/claw/README.md, steps 1-2).

Scenarios

• Given a PR that changes no .t27, When claw-sarif runs, Then it mints no token and passes.
• Given a PR with a changed .t27 and an installation without the permission, When claw-sarif runs, Then it uploads nothing, says why in the step summary, and does not fail.
• Given the permission granted, When a changed spec does not parse, Then the SARIF alert T27C001 appears on the PR.

Requirements

• FR-001: The job MUST NOT request a token before it knows a .t27 changed.
• FR-002: A missing App permission MUST degrade to a step-summary note, as docs/claw/README.md documents.

Success Criteria

• claw-sarif concludes success or skipped on a Markdown-only PR.
• claw-sarif concludes success on a .t27 PR while the permission is still missing, with the note in its step summary.