The cloud agent’s GitHub installation token does not include the issues scope. The GitHub App requests broad permissions at the app level (which users see in installation settings), but the token actually minted for the sandbox is scoped more narrowly.
We have an open issue here to figure out what to do (either add issues scope to background agent runner GitHub token or update docs to remove Issues from supported permissions. Have added your feedback to that ticket!