Fix autograder PR review permissions

[danielrazavi]

Summary

The autograder approval flow used to work, but recently it stopped posting approvals or change requests even when the tests passed. We traced the likely cause to GitHub Actions token permissions: newer forked repositories can default to read-only GITHUB_TOKEN permissions, which lets the autograder run but prevents it from approving or requesting changes on the PR.

This PR adds the possible fix by explicitly granting the workflow permission to write pull request reviews, and by making the autograder fail visibly if GitHub rejects the review API call.

Testing

Tested using the same workflow participants follow:

• Forked the repo
• Cloned the fork locally
• Completed the assignment on an assignment branch
• Pushed the branch
• Opened a PR from assignment into the fork’s main
• Confirmed the autograder flow using this receipt PR: danielrazavi/shell#2

Changes

• Adds explicit pull-requests: write permission to the autograder workflow.
• Keeps contents: read as the minimal repository content permission.
• Raises an error if the GitHub PR review API call fails, instead of silently passing.

[github-actions]

Thanks for your contribution! 🎉

Please remember to tag or request a review from the DSI team. Give us up to 72 hours to review your pull request. We appreciate your patience and efforts.

[Dmytro-Bonislavskyi]

Well done :) !