feat: add tool-request pipeline for automated tool creation

- Add pipeline spec at .claude/pipelines/tool-request.md
- Add workflow to trigger Claude on 'tool-request' label
- Add auto-close workflow for published issues (24h)
- Update claude.yml with write permissions and NPM_TOKEN
- Create labels: tool-request, claude-working, validation-failed, published, escalated

Pipeline flow:
1. Maintainer applies 'tool-request' label to issue
2. Claude analyzes, designs, implements, validates, publishes
3. Issue auto-closes 24h after successful publish

.github/workflows/claude.yml

@@ -19,11 +19,11 @@ jobs:
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      pull-requests: read
-      issues: read
+      contents: write      # Push branches, create commits
+      pull-requests: write # Create and manage PRs
+      issues: write        # Manage labels, close issues
       id-token: write
-      actions: read # Required for Claude to read CI results on PRs
+      actions: read        # Read CI results on PRs
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -33,10 +33,13 @@ jobs:
       - name: Run Claude Code
         id: claude
         uses: anthropics/claude-code-action@v1
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          CRON_SECRET: ${{ secrets.CRON_SECRET }}
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
-          # This is an optional setting that allows Claude to read CI results on PRs
+          # Allow Claude to read CI results and manage issues/PRs
           additional_permissions: |
             actions: read