fix(stale): document the permission the upstream cache needs

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>

Author: yordis

actions/stale/README.md

@@ -23,12 +23,19 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
+      actions: write
       issues: write
       pull-requests: write
     steps:
       - uses: TrogonStack/github-actions/actions/stale@<sha> # vX.Y.Z
 ```
 
+`actions: write` is not optional. Upstream keeps its progress in the Actions
+cache so a run capped by `operations-per-run` resumes where the last one
+stopped, and managing that cache entry needs the permission. Without it the
+cache delete fails with a 403, every run replays the same prefix of the
+backlog, and anything past that prefix is never closed.
+
 Run it once with `debug-only: true` before pointing it at a repository with
 years of backlog, so the first real run is not a surprise.
 
@@ -52,9 +59,9 @@ remove.
 | --- | --- | --- |
 | `days-before-stale` | `60` | Days without activity before marking stale. |
 | `days-before-close` | `7` | Days after marking before closing. `-1` marks but never closes. |
-| `operations-per-run` | `100` | API operations budget for one run. |
+| `operations-per-run` | `100` | API operations budget for one run. A run that hits the cap resumes from where it stopped. |
 | `debug-only` | `false` | Report what would happen and change nothing. |
-| `token` | `github.token` | Needs write access to issues and pull requests. |
+| `token` | `github.token` | Needs write access to actions, issues, and pull requests. |
 
 ## Fixed behaviour