docs: development.md says the converters job reads the private corpus only through a grant in that repository's Actions settings, and what the checkout error looks like without it (#232 close)

Files changed:
- docs/dev/development.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

docs/dev/development.md

@@ -202,8 +202,10 @@ in the private repository alone: a push there starts nothing here. It always tes
 private repository, so a converter change that alters an expected output is two commits, the
 private one first. Before a release without suffix, `release.yml` runs the same steps as a job its
 release job waits for; a red harness ends the run before a release or a tag exists, and a
-`-beta.N` candidate skips it. The job reads the private repository with the per-job token; if
-that instance ever stops allowing this, the workflow's header names the 1Password fallback.
+`-beta.N` candidate skips it. The job reads the private repository with the per-job token, which
+works only because the private repository's own Actions settings grant `torben/chemenu` access;
+without that grant the checkout step fails with "Determining the default branch … not found",
+which reads like a missing repository rather than a missing permission.
 
 Three more workflows carry the live tests of the tracker adapters (Super Productivity, CalDAV):
 `ci.yml` runs the CalDAV half in a step of its own against Radicale as a process,