## Context
The PR size check workflow has been failing with `403 Resource not
accessible by integration` on every run
([example](https://github.com/zed-industries/zed/actions/runs/23281894554/job/67698634490)).
The root cause is a workflow-level `permissions` block that set a
read-only ceiling, silently preventing the job-level `issues: write` and
`pull-requests: write` grants from taking effect.
This also adds an idempotency improvement: when a new push doesn't
change the PR's size bracket, the workflow now skips the label
remove/re-add cycle, eliminating unnecessary timeline noise.
## How to Review
- Focus on `.github/workflows/pr-size-check.yml` — that's the only file
changed
- Lines 17-23: workflow-level `permissions` block removed, job-level
retained
- Lines 81-112: new `alreadyCorrect` check wraps the label mutation
block
## Self-Review Checklist
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- N/A
John D. Swanson
f7be37fc47