Fix missing permissions block in build-gate orchestrator

[ehl-jf]

Follow-up to #1578. The build-gate.yml orchestrator was missing a top-level
permissions block, causing the workflow to fail with:

Error calling workflow frogbot-scan-pull-request.yml. The workflow is requesting
pull-requests: write, but is only allowed pull-requests: none.

Fix

Added permissions: pull-requests: write / contents: read at the workflow level so
the frogbot reusable workflow can write PR comments.

Required follow-up (repo settings)

• Create the build-gate GitHub Environment with Required reviewers.
• Repoint required status checks in branch protection to Build Gate / build-gate-success.