The implementation-worker has a PR fix mode that needs to read PR changes
to understand what is failing. However, it lacked forgejo_list_pull_request_files
and forgejo_get_pull_request_diff permissions, forcing it to clone the entire
repository just to inspect what files changed.
The pr-reviewer agent already has both permissions. This change aligns the
implementation-worker permissions with its actual usage patterns and reduces
unnecessary full-repo clones in PR fix mode.
Also adds curl, printenv, and echo bash permissions that were inadvertently
omitted from the permission block. These are needed for the agent to make
Forgejo API calls, check environment variables, and perform basic shell
operations.
ISSUES CLOSED: #8175
HAL9000
49ecf7ff8f