ci: clarify that cleanup_caches and comment don't use token permissions