test(e2e): tolerate per-cycle 403 (missing perm / feature gate)

A cycle whose fetchLive 403s (App lacks that permission, or the feature
isn't on the org's plan) is now skipped with a warning rather than failing
the suite — while still asserting fetchLive only issued GETs even on the
failure path. Keeps the harness robust to the App's permission scope;
grant the org read scopes for fuller coverage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: lex00

e2e/warden.e2e.test.ts

@@ -203,7 +203,26 @@ suite("warden e2e (real GitHub org)", () => {
       const rec = recording(client);
       const budget = makeBudget();
 
-      const live = await cycle.fetchLive(rec.client, ORG!, scope, budget);
+      let live;
+      try {
+        live = await cycle.fetchLive(rec.client, ORG!, scope, budget);
+      } catch (err) {
+        // fetchLive only ever issues GETs — assert that even on the failure
+        // path, then treat a 403 (the App lacks that permission, or the feature
+        // is unavailable on the org's plan) as "not exercisable here" rather
+        // than a failure. Keeps the harness robust to the App's permission
+        // scope; the warning shows which cycles need broader grants.
+        const nonGet = rec.calls.filter((c) => c.method !== "GET");
+        expect(nonGet, `${cycle.name}.fetchLive made a non-GET before failing`).toEqual([]);
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes("403")) {
+          // eslint-disable-next-line no-console
+          console.warn(`[e2e] ${cycle.name}: skipped (403) — ${msg.slice(0, 140)}`);
+          return;
+        }
+        throw err;
+      }
+
       const desired = cycle.buildDesired(orgConfig, ORG!, scope);
       const changeSet = diff(ORG!, desired, live, {});