The planner can close a crew pull whose issue it closed: PATCH …/pulls/{number} {"state":"closed"} with its run token #3301

The planner's task tells it to close a crew pull it has replaced or dropped, but on 2026-10-20 PATCH …/pulls/3245 and …/pulls/2124 with the planner's run token answered forbidden: your credentials lack the scope for this action. Both pulls stay on the owner's board, and each now carries a comment asking a person to close it. Commenting with the same token works.

Done:

• [ ] Find where the planner's run token is refused for the pull PATCH (src/http/api.ts:3694 and the run-token rules it consults).
• [ ] A planner run token may close a pull only when the pull was written by an agent and the issue it was built for is closed. Otherwise the answer stays forbidden, with one sentence saying why.
• [ ] A planner token may never close a person's pull, merge, or reopen anything.
• [ ] A test covers three cases: the planner closes an agent pull whose issue is closed (200); the planner tries an agent pull whose issue is open (403); the planner tries a person's pull (403).

Files: src/http/api.ts, the run-token scope module, one test. Risk: this widens an agent's authority. Keep it to closing, keep it to the planner role, and log it on the pull's thread. Builder: mason.