Document caller prerequisite: csharp-ci/scala-ci ≥2.4.0 require callers to grant actions:read (+ pull-requests:write)

[monsieurleberre]

2.4.0's matrix-comment job (#36) requests actions: read and pull-requests: write. A called workflow cannot request a permission its caller's permissions: block doesn't grant, and GitHub validates this statically at run creation — a caller missing the grant gets startup_failure on every run (all event types, no jobs created, no error surfaced in the API). This took out CI in 10 consumer repos org-wide from 2026-07-14 07:09Z (when the floating v2 tag moved) until the consumer-side grants started landing on 2026-07-17.

Follow-ups:

• README caller-prerequisites section: minimum permissions: block for csharp-ci/scala-ci ≥2.4.0 (actions: read, contents: read, packages: read, pull-requests: write)
• CHANGELOG note under [2.4.0] is frozen — add an [Unreleased] clarification entry instead
• Consider: startup-failure-proofing future permission additions (they are breaking for restricted callers → major bump per SemVer), or re-landing matrix-comment artifact-based (render from the per-shard ci-results artifacts like matrix-output does) so no extra caller permission is needed
• Remaining consumers to grant (already fixed: daml-codegen-csharp-internal#637, canton-ledger-api-csharp-internal#320, daml-codegen-csharp#29): bosun, budget, canton-dotnet-sdk-mini-demo(+-internal), canton-ledger-api-csharp, canton-localnet(+-internal, csharp.yml)

Context: #37 (provider-side revert, closed in favor of consumer-side grants).