REQ-CI-003: The cross-repo permission is requested explicitly and a refusal fails with an actionable message

Opening the pin-bump pull request needs write access to fangorn/anvil, which the pipeline requests through the permissions: block in .anvil.yml. That block is only a request — anyone able to open a pull request here can edit it — so it can only narrow what fangorn/anvil has granted, never widen it, and the grant itself is created by an admin of that repository. The scopes ride on the ordinary per-job ANVIL_TOKEN; no separately provisioned CI secret exists. When the token is absent, or when the cross-repo request is refused because no grant covers it, the step fails with a message naming the repository, the approval that is missing and the scopes it needs — never half-completing, and never skipping silently as though there were nothing to do.