Scope release-notes tool allowlist for Phase 3 experts

[reyortiz3]

Summary

• The release-notes.yml workflow's --allowedTools "Bash(gh *),Bash(git *),..."
  was scoped only to what the top-level skill procedure needs (gh/git
  read-only lookups). It didn't account for the Phase 3 expert subagents
  (kubernetes-expert, mcp-protocol-expert, oauth-expert, toolhive-expert,
  site-reliability-engineer) dispatched via Task — their own agent
  definitions declare Bash for local code exploration, and three of them
  also declare WebFetch and/or mcp__context7__* tools that were never
  allowlisted.
• This caused the v0.45.0 release-notes run to hit 42 permission denials as
  subagents retried/worked around denied calls, pushing it to 75 turns
  against the 60-turn cap and failing the job outright (see
  https://github.com/stacklok/toolhive/actions/runs/32973912326).
• Add WebFetch and the two context7 tools, and extend the Bash(...)
  scoping with the read-only exploration commands the experts actually run
  (grep, rg, find, cat, ls, head, tail, go doc) instead of
  opening Bash up fully. This job runs unattended over PR/issue content it
  doesn't control, so network and write-capable commands (curl, go get/install, gh release edit, etc.) stay blocked.
• Left --max-turns at 60: the overrun was caused by denial-driven retries,
  not raw workload size, so the existing budget should be enough headroom
  once the denials stop.

Type of change

• Bug fix

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

Manually dispatched release-notes.yml from this branch for the v0.45.0 tag
(https://github.com/stacklok/toolhive/actions/runs/32979534915) with the
earlier, fully-unrestricted-Bash version of this fix, confirming the Phase 3
subagents no longer hit permission denials and the run completes within
budget (release notes generated, PR comment posted, Slack announcement
sent). The Bash allowlist was subsequently tightened to the scoped set
above; re-running against the scoped set is a lower priority since the
mechanism (allowing the specific tools/commands the experts use) is the
same, just narrower.

Does this introduce a user-facing change?

No — CI workflow configuration only.

Special notes for reviewers

This branch was also used to manually regenerate the v0.45.0 release notes
(which failed via the original workflow_run trigger) since the fix wasn't
on main yet at release time.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.99%. Comparing base (fd1d228) to head (2de6fc7).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6439      +/-   ##
==========================================
+ Coverage   77.94%   77.99%   +0.04%     
==========================================
  Files         766      766              
  Lines       74069    74069              
==========================================
+ Hits        57732    57767      +35     
+ Misses      16332    16297      -35     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.