ci(claude-review): allowlist Write too (review writes a helper script)

The log shows two gated tools, not one: compound Bash pipelines AND Write — the
review tried to drop check_headings.py (at /tmp, then the workdir, both denied).
Add Write to the allowlist.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>