fix(release): keep skillspector PR comments non-blocking

.github/workflows/skill-release.yml

@@ -833,7 +833,7 @@ jobs:
       actions: read
       contents: read
       issues: write
-      pull-requests: read
+      pull-requests: write
     steps:
       - name: Download SkillSpector reports
         continue-on-error: true
@@ -843,6 +843,7 @@ jobs:
           path: skillspector-pr-reports
 
       - name: Comment SkillSpector reports
+        continue-on-error: true
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |

scripts/test-skill-release-workflow.mjs

@@ -250,7 +250,7 @@ assert.match(
 
 assert.match(
   workflow,
-  /comment-skillspector-report:[\s\S]*needs: release[\s\S]*issues: write[\s\S]*actions\/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\.0\.1/,
+  /comment-skillspector-report:[\s\S]*needs: release[\s\S]*issues: write[\s\S]*pull-requests: write[\s\S]*actions\/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\.0\.1/,
   'Skill release workflow must download generated SkillSpector reports in a separate PR comment job with comment permissions',
 );
 
@@ -260,6 +260,12 @@ assert.match(
   'SkillSpector PR comments must still run when the release dry-run produced reports but the release job failed later',
 );
 
+assert.match(
+  workflow,
+  /Comment SkillSpector reports[\s\S]*continue-on-error: true[\s\S]*actions\/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9\.0\.0/,
+  'SkillSpector PR comment publishing must not fail the release dry-run check',
+);
+
 assert.match(
   workflow,
   /function sanitizeReportForComment\(report\)[\s\S]*code block omitted from PR comment[\s\S]*inline snippet omitted[\s\S]*redacted-email[\s\S]*redacted-token/,