fix: grant GITHUB_TOKEN packages:write so crank xpkg push succeeds

Without an explicit permissions block the token defaults to read-only
for packages, causing GHCR to deny the xpkg push with "installation
not allowed to Create organization package".

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>