fix(ci): grant contents:write so tag watcher can create repository_dispatch