fix(auto-revert): handle workflow-file commits instead of failing on them

[nkg]

auto-revert pushes with GITHUB_TOKEN, which GitHub categorically forbids from
creating or updating anything under .github/workflows/. workflows is not among
the grantable permissions: scopes, so this was never a misconfiguration anyone
could correct -- the capability does not exist for that token.

The failure mode was poor. The push was rejected only after the revert commit
had been made, so the job died with

refusing to allow a GitHub App to create or update workflow
.github/workflows/ci.yml without workflows permission

which reads like a setup error, and buried the CI failure it was reacting to
under a second red check.

Now the job detects the case before committing and opens an issue instead, so
the regression is still surfaced loudly and the check stays green. Callers need
issues: write; the example stub is updated.

Two latent bugs surfaced while fixing it. The path check must diff against the
first parent: git diff-tree -r <sha> lists nothing for a merge commit, and the
bad SHA is usually a merge, so the naive check would never have fired on the
case that matters. And it follows that auto-revert has never once succeeded
against a workflow-file regression in any consumer.

For full automation, revert-app-client-id plus a REVERT_APP_PRIVATE_KEY
secret mints a scoped installation token with permission-workflows: write and
pushes with that. Both optional; unset keeps today behaviour plus the issue
fallback. The docs call for a dedicated App rather than reusing deps-reader,
which is deliberately contents:read only -- a credential that can rewrite
workflow files can rewrite CI itself.

Verified: actionlint clean; the run: block extracted and shellcheck -S warning
clean; the heredoc rendered and its output inspected; diff-vs-first-parent
checked against a real merge commit, where diff-tree -r returns 0 paths and
diff ^1 correctly returns .github/workflows/ci.yml.

Test plan

• actionlint clean.
• run: block extracted and shellcheck -S warning clean.
• Heredoc executed standalone and the rendered issue body inspected.
• The merge-commit case checked against a real merge in extractor-llm: git diff-tree --no-commit-id --name-only -r <sha> returns 0 paths, git diff <sha>^1 <sha> correctly returns .github/workflows/ci.yml.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EoicTZniGXry3W7YFZBsSM