Codemod 'Convert write permissions to read' incorrectly changes id-token: write to read

[deyaaeldeen]

Bug

The gh aw upgrade codemod "Convert write permissions to read" blindly converts all write permission values to read, including id-token.

However, id-token only accepts write or none — read is not a valid value. This causes compilation to fail:

.github/workflows/sdk-generation-agent.md:26:13: error: 'id-token': value must be one of 'write', 'none'

Steps to Reproduce

1. Have a workflow with id-token: write in the permissions block
2. Run gh aw upgrade
3. The codemod changes id-token: write to id-token: read
4. Compilation fails

Expected Behavior

The codemod should skip id-token since it only accepts write or none.

Versions

• gh-aw: v0.68.0 (also reproduced on v0.67.4)
• OS: Linux x86_64