feat: add opt-in write access for all token-visible repos

tests/test_policy.py

@@ -125,3 +125,20 @@ def test_write_mode_repository_whitelist(monkeypatch: pytest.MonkeyPatch, tmp_pa
 
     assert allowed.allowed
     assert denied.allowed is False
+
+
+def test_write_mode_allow_all_token_repos(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """Write mode can be configured to allow all repos accessible to token."""
+    _set_base_env(monkeypatch)
+    monkeypatch.setenv("WRITE_MODE", "true")
+    monkeypatch.setenv("WRITE_ALLOW_ALL_TOKEN_REPOS", "true")
+
+    policy_path = tmp_path / "policy.yaml"
+    policy_path.write_text("defaults:\n  write: allow\n", encoding="utf-8")
+
+    reset_settings()
+    _ = get_settings()
+    engine = PolicyEngine.from_yaml_file(policy_path)
+
+    decision = engine.authorize("create_issue", is_write=True, repository="acme/any-repo")
+    assert decision.allowed