fix(ci): grant CLA bot pull-request write permission (#115)

The CLA Assistant workflow had `pull-requests: read`, which prevented
the GITHUB_TOKEN from posting the sign-CLA comment on PRs. Change to
`pull-requests: write` so the bot can comment.

Also removed the `protect-cla-signatures` ruleset (GitHub-side) that
marked the signatures branch as protected, blocking the bot from
pushing signature records.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/cla.yml

@@ -21,7 +21,7 @@ on:
 # branch-protection required check (cla/cla-assistant.yml) reports against.
 permissions:
   contents: read
-  pull-requests: read
+  pull-requests: write
   issues: write
   statuses: write