Your API reading is correct. The current Packages REST API does not expose the entries under Manage Actions access, and there is no equivalent GraphQL mutation. permissions: packages: write only narrows the caller repository’s GITHUB_TOKEN; it cannot grant that repository access to an existing package. Calling a reusable workflow does not change this, because the called workflow still uses the caller repository’s token.

The supported automation options today are therefore architectural workarounds:

1. Push with a classic PAT that has write:packages, owned by a dedicated organization/bot account that already has write access to the package. Store it as an organization Actions secret and restrict which repositories/environments can receive it. GitHub Packages still documents a classic PAT—not a fine-grained PAT—for this case.
2. Run the publishing job in a fixed repository that is already linked or granted write access to the package. Trigger that repository’s own workflow, rather than only calling it as a reusable workflow, so its own GITHUB_TOKEN is used.
3. For newly designed packages, publish first from the intended owning repository and include the org.opencontainers.image.source label so the package is linked before publication and can inherit that repository’s permissions. This does not solve granting thousands of changing caller repositories write access to an existing package.

So the requested API is a real gap: if adding each generated repository to the package’s Actions access list is a hard requirement, there is currently no supported way to automate that same UI operation.

Current GitHub documentation:

• https://docs.github.com/en/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility#ensuring-workflow-access-to-your-package
• https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-in-a-github-actions-workflow

There is currently no REST API to manage repo-to-package access. The packages REST API only supports package/version operations like list, get, delete, and restore. github docs confirm that adding a repo to an existing package can only be done from Package settings > Manage Actions access > Add repo. There is no api for this today.
One workaround is using the org.opencontainers.image.source label before the package is first published, so it inherits access from the linked repo. But this doesnt help for an already-published package.

So IMO, best option is to raise this as a feature request through GitHub’s feedback channel.