ci: fix deploy.yml permissions and secrets for reusable workflow

Deploy workflow must declare `permissions: contents: write` at workflow level
to allow the nested reusable ci.yml (which needs write for phpcbf auto-commit)
to run. Also adds `secrets: inherit` to the ci job so secrets propagate through.

Pre-existing issue introduced during CI standardization (startup_failure root cause).

Agent-Session: fix-e2e-ref-20260617

.github/workflows/ci.yml

@@ -3,7 +3,7 @@
 #
 # Delegates all lint/test/file-size jobs to the estate reusable workflow.
 # Per estate standard: workflow_call is required so deploy.yml can gate on it.
-# See: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main for job definitions.
+# See: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main for job definitions.
 ##
 name: CI
 
@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   ci:
-    uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
+    uses: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main
     with:
       tests: stubs
       has_js: true

.github/workflows/deploy.yml

@@ -5,7 +5,7 @@ on:
     branches: [ main ]
 
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: deploy-peptide-reconstitution-calculator
@@ -15,11 +15,12 @@ jobs:
   ci:
     name: Pre-deploy CI
     uses: ./.github/workflows/ci.yml
+    secrets: inherit
 
   deploy:
     name: Deploy (shared pipeline)
     needs: ci
-    uses: peptiderepo/peptide-e2e/.github/workflows/deploy-app.yml@main
+    uses: peptide-repo/peptide-e2e/.github/workflows/deploy-app.yml@main
     with:
       target_path: wp-content/plugins/peptide-reconstitution-calculator
     secrets: inherit