Document reusable attestation token scope

[firegrass]

What changed

• document the caller permission required by GitHub's reusable-workflow negotiation
• show the complete permission block in the Cargo example
• clarify that disabling derived-image provenance skips the write even though the scope must be granted

Why

The first private canary rerun exposed this GitHub platform nuance as a startup failure before any job was created.

Validation

• Markdown diff is whitespace-clean
• the corrected private caller now starts successfully and skips the attestation step

Refs BKLG-20260803-0d11.