ci: fix pre-commit EOF and grant TOC push permission (#2)

- end-of-file-fixer: trim the double trailing newline on two openspec spec files so pre-commit passes (verified: pre-commit run --all-files is green).
- toc.yaml: add permissions.contents=write so the TOC generator's push to main stops 403-ing as github-actions[bot].

Does not touch the pytest/Docker core-checkout harness (PHCC migration) — that is a separate, design-level change.

.github/workflows/toc.yaml

@@ -6,6 +6,8 @@ jobs:
   generateTOC:
     name: TOC Generator
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: technote-space/toc-generator@v4
         with:

openspec/specs/options-flow/spec.md

@@ -264,4 +264,3 @@ On `async_setup_entry`, the integration SHALL scan the entity registry for entit
 - **WHEN** the integration runs the sleep-switch cleanup
 - **AND** another integration owns a similarly named entity (e.g., a user-created `switch.adaptive_lighting_sleep_mode_demo` template switch)
 - **THEN** that foreign entity SHALL NOT be removed from the entity registry
-

openspec/specs/runtime-range-controls/spec.md

@@ -195,4 +195,3 @@ Moving the slider SHALL NOT trigger an integration reload, matching the no-reloa
 - **WHEN** the curve is evaluated 45 minutes after today's sunset
 - **THEN** the day-anchoring SHALL still resolve the pair to today's events
 - **AND** the computed brightness SHALL lie strictly between the profile's minimum and maximum (the down-ramp is still in progress, not snapped to minimum)
-