cb5daf58ce
The CLA Assistant workflow had `pull-requests: read`, which prevented the GITHUB_TOKEN from posting the sign-CLA comment on PRs. Change to `pull-requests: write` so the bot can comment. Also removed the `protect-cla-signatures` ruleset (GitHub-side) that marked the signatures branch as protected, blocking the bot from pushing signature records. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>