feat(commands): default command-authorization policy entries for review/pause/resume/resolve/configuration/explain

[JSONbored]

DEFAULT_COMMAND_AUTHORIZATION_POLICY (src/settings/command-authorization.ts:3) enumerates the roles allowed to invoke each maintainer command; MAINTAINER_ONLY_DEFAULT_COMMANDS is derived from its keys (:24) and the normalizer clamps spoofable roles off those commands (:144). The new #1960 verbs need conservative default entries so they behave as maintainer/collaborator-only out of the box and get the author-role clamp. PURE config + normalizer tests — no handler/dispatch changes.

Deliverables

• Add entries to DEFAULT_COMMAND_AUTHORIZATION_POLICY.commands for "review","pause","resume","resolve","configuration","explain" (default ["maintainer","collaborator"]; keep "review" widenable to confirmed_miner per the refactor(github-app): extract a shared withAuthorizedPrAction scaffold for action commands #824 self-rerun precedent already applied to review-now)
• Confirm each new key flows through MAINTAINER_ONLY_DEFAULT_COMMANDS (src/settings/command-authorization.ts:24) so normalizeCommandRoleList clamps a spoofable pr_author role for them (:144)
• Unit tests in test/unit/command-authorization.test.ts: each new command returns the expected allowedRoles via commandAuthorizationAllowedRoles, and a config that adds pr_author to one of them is clamped with the warning (both branches of the clamp)

References

• src/settings/command-authorization.ts:3 (DEFAULT_COMMAND_AUTHORIZATION_POLICY)
• src/settings/command-authorization.ts:24 (MAINTAINER_ONLY_DEFAULT_COMMANDS)
• src/settings/command-authorization.ts:144 (normalizeCommandRoleList clamp)
• test/unit/command-authorization.test.ts
• #1960

Part of #1960.

---

size: XS · held for later release (gittensor:bug once activated)

[linear-code]

JSO-2263