fix(github-app): authorize PR panel reruns

[JSONbored]

Motivation

• Close an authorization gap that allowed any non-bot user who can edit the bot-authored PR panel comment to trigger public-surface publishing with the app installation token.
• Ensure PR panel manual reruns obey the same review-now/command-authorization policy used for mention commands so only authorized maintainers/collaborators (or allowed PR authors) can trigger public side effects.

Description

• Add getRepositoryCollaboratorPermission helper in src/github/app.ts which queries the repository collaborator permission for a given login using an installation token.
• Gate the PR panel rerun path in src/queue/processors.ts by resolving the editing actor's repo association via resolvePrPanelRetriggerActorAssociation, running the existing isAuthorizedCommandActor (policy: review-now), and skipping with audit/usage records when unauthorized.
• Keep prior behavior for bot senders and missing context, and preserve the normal public-surface flow for authorized invocations; only add the permission lookup and authorization decision before calling maybePublishPrPublicSurface.
• Add/adjust unit test coverage in test/unit/queue.test.ts to assert both an authorized maintainer rerun and a denied low-permission rerun are handled and audited correctly.

Testing

• Ran the modified unit tests with npx vitest run test/unit/queue.test.ts --reporter=verbose, which passed (51 tests in the file) including the new unauthorized rerun test.
• Ran type-checking with npm run typecheck, which succeeded.
• Attempted full CI npm run test:ci, but it was blocked in this environment because actionlint hit transient DNS errors and the coverage step failed due to a missing local dependency (semver/functions/gte) required by Istanbul/make-dir (external/tooling issue), so test:ci could not complete here.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	6e08f1e	Commit Preview URL Branch Preview URL	Jun 10 2026, 08:49 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#515 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.