Reconcile FGP annotations to docs-authoritative permissions

Verify per-tool fine-grained permissions against the GitHub REST docs'
embedded permission sets (progAccess.permissions):

- merge_pull_request: contents:write only (was contents:write AND
  pull_requests:write)
- update_pull_request_branch: pull_requests:write only (was contents:write
  AND pull_requests:write)
- list_repository_collaborators: metadata:read (was administration:read)
- create_repository: re-add administration:write
- fork_repository: re-add administration:write AND contents:read

Regenerate docs/permissions-filtering.md (55 rows; idempotent).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

docs/permissions-filtering.md

@@ -80,14 +80,16 @@ The generated table below is produced by `script/generate-docs` and lists every
 | `pull_requests` | `add_reply_to_pull_request_comment` | `pull_requests:write` |
 | `pull_requests` | `create_pull_request` | `pull_requests:write` |
 | `pull_requests` | `list_pull_requests` | `pull_requests:read` |
-| `pull_requests` | `merge_pull_request` | `contents:write AND pull_requests:write` |
+| `pull_requests` | `merge_pull_request` | `contents:write` |
 | `pull_requests` | `pull_request_read` | `pull_requests:read` |
 | `pull_requests` | `pull_request_review_write` | `pull_requests:write` |
-| `pull_requests` | `update_pull_request_branch` | `contents:write AND pull_requests:write` |
+| `pull_requests` | `update_pull_request_branch` | `pull_requests:write` |
 | `pull_requests` | `update_pull_request` | `pull_requests:write` |
 | `repos` | `create_branch` | `contents:write` |
 | `repos` | `create_or_update_file` | `contents:write` |
+| `repos` | `create_repository` | `administration:write` |
 | `repos` | `delete_file` | `contents:write` |
+| `repos` | `fork_repository` | `administration:write AND contents:read` |
 | `repos` | `get_commit` | `contents:read` |
 | `repos` | `get_file_contents` | `contents:read` |
 | `repos` | `get_latest_release` | `contents:read` |
@@ -96,7 +98,7 @@ The generated table below is produced by `script/generate-docs` and lists every
 | `repos` | `list_branches` | `contents:read` |
 | `repos` | `list_commits` | `contents:read` |
 | `repos` | `list_releases` | `contents:read` |
-| `repos` | `list_repository_collaborators` | `administration:read` |
+| `repos` | `list_repository_collaborators` | `metadata:read` |
 | `repos` | `list_tags` | `contents:read` |
 | `repos` | `push_files` | `contents:write` |
 | `secret_protection` | `get_secret_scanning_alert` | `secret_scanning_alerts:read` |

pkg/github/pullrequests.go

@@ -1434,7 +1434,7 @@ func MergePullRequest(t translations.TranslationHelperFunc) inventory.ServerTool
 			}
 
 			return utils.NewToolResultText(string(r)), nil, nil
-		}).WithPermissions(permissions.Require(permissions.PullRequests.Write(), permissions.Contents.Write()))
+		}).WithPermissions(permissions.Require(permissions.Contents.Write()))
 }
 
 // SearchPullRequests creates a tool to search for pull requests.
@@ -1591,7 +1591,7 @@ func UpdatePullRequestBranch(t translations.TranslationHelperFunc) inventory.Ser
 			}
 
 			return utils.NewToolResultText(string(r)), nil, nil
-		}).WithPermissions(permissions.Require(permissions.PullRequests.Write(), permissions.Contents.Write()))
+		}).WithPermissions(permissions.Require(permissions.PullRequests.Write()))
 }
 
 type PullRequestReviewWriteParams struct {

pkg/github/repositories.go

@@ -676,7 +676,7 @@ func CreateRepository(t translations.TranslationHelperFunc) inventory.ServerTool
 
 			return utils.NewToolResultText(string(r)), nil, nil
 		},
-	)
+	).WithPermissions(permissions.Require(permissions.Administration.Write()))
 }
 
 // FetchRepoIsPrivate returns whether a repository is private. It is a thin
@@ -986,7 +986,7 @@ func ForkRepository(t translations.TranslationHelperFunc) inventory.ServerTool {
 
 			return utils.NewToolResultText(string(r)), nil, nil
 		},
-	)
+	).WithPermissions(permissions.Require(permissions.Administration.Write(), permissions.Contents.Read()))
 }
 
 // DeleteFile creates a tool to delete a file in a GitHub repository.
@@ -2795,5 +2795,5 @@ func ListRepositoryCollaborators(t translations.TranslationHelperFunc) inventory
 			callResult = attachStaticIFCLabel(ctx, deps, callResult, ifc.LabelCollaboratorRoster())
 			return callResult, nil, nil
 		},
-	).WithPermissions(permissions.Require(permissions.Administration.Read()))
+	).WithPermissions(permissions.Require(permissions.Metadata.Read()))
 }