fix: grant Renovate statuses write permission

[cryptodev-2s]

Explanation

After #10311 the lockfile update works and Renovate pushes a branch, but still no pull request. It aborts one step later:

INFO: Branch created (commitSha 8aadb644...)
DEBUG: Updating renovate/stability-days status check state to green
POST https://api.github.com/repos/MetaMask/core/statuses/8aadb644... = 403
GitHub failure: Resource not accessible by integration
x-accepted-github-permissions: statuses=write
DEBUG: Caught error setting branch status - aborting
Error: integration-unauthorized
INFO: Repository has changed during renovation - aborting

Renovate posts a commit status on every branch it pushes, and our token grant has no statuses scope, so the 403 ends the whole repository run before ensurePr. The closing "Repository has changed" line is just how that abort surfaces, nothing had actually changed.

The alternative was disabling the checks with statusCheckNames, but renovate/artifacts and renovate/config-validation are how a partially failed lockfile update or a bad renovate.json show up on the pull request instead of only in a debug log, so they are worth keeping.

Important

Depends on consensys-vertical-apps/token-exchange-service#182, which grants the permission. Merging this first makes the token exchange reject the request and the job fail outright, so it stays a draft until that lands.

References

Follows #10311. Part of WPC-1161.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Workflow-only permission scope change for the Renovate bot token; no application runtime impact, but the job fails until the token exchange service allows statuses: write.

Overview
Renovate was failing after pushing branches because the exchanged GitHub token could not set commit statuses (403, statuses=write required), which aborted the run before pull requests were created.

This adds statuses: write to the permissions requested in the Renovate workflow’s get-token step so Renovate can mark checks such as renovate/stability-days and keep renovate/artifacts / renovate/config-validation visible on PRs.

Note: The token exchange service must grant the same permission (see PR dependency); merging before that service change will cause token requests to fail.

^{Reviewed by Cursor Bugbot for commit 481f6b7. Bugbot is set up for automated code reviews on this repo. Configure here.}