feat(github-app): add repo-level command authorization policy

[JSONbored]

Parent roadmap: #82

Background

Different repos may want different rules for who can invoke public @gittensory commands.

Goal

Add repo-level policy for maintainer, collaborator, PR author, and confirmed-miner command authorization.

Current Behavior

Authorization rules exist in code, but repo-specific policy is not flexible enough.

Desired Behavior

Repo owners can configure which roles can run which commands while safe defaults remain strict.

Implementation Requirements

• Add settings schema for command authorization.
• Preserve secure defaults.
• Apply policy during issue_comment handling.
• Include policy in diagnostics/preview.
• Audit denied commands.

Public/Private Output Boundaries

Public GitHub output must stay quiet-by-default and sanitized. It must not include private reviewability, scoreability, reward/risk, raw trust, wallet/hotkey, or public score estimates.

Acceptance Criteria

• Maintainers can run all enabled commands by default.
• PR authors can run allowed own-PR commands.
• Unauthorized users fail closed.
• Policy changes are reflected in preview/diagnostics.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally to avoid CI variance.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, queue pressure, source-upload safety, public/private boundaries, or upstream drift.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.
• MCP/local tooling must prove source contents are not uploaded.

Additional Test Scenarios

• Maintainer allowed fixture.
• PR author allowed fixture.
• Unauthorized denied fixture.
• Policy override fixture.
• Public sanitizer regression.