fix: use event sender type for actor validation

[EffortlessSteven]

What this does

In the reported labeled-event flow, the repository permission check succeeds, but checkHumanActor() (the actor gate for both tag and agent mode) then performs a separate Users API lookup that can fail with Bad credentials before Claude starts.

Fix: classify the actor from the event sender when its login matches context.actor, and fall back to the Users API only when sender metadata is missing or inconsistent. The allowed_bots policy and existing 404 handling are unchanged.

Verification

Red on main, green after: the skip-API cases abort on the unpatched Users API lookup; the two fallback cases pass on both sides by design (preserved behavior).

Check	Result
pull_request.labeled / issues.labeled human sender	unpatched aborts on API, patched succeeds without it
workflow_dispatch typed sender	succeeds without the API
disallowed / allowed bot sender	rejected / accepted, no API call
sender/actor mismatch, senderless schedule	existing Users API fallback
prettier, tsc --noEmit, bun test	clean, 776 passed

Review map

• src/github/validation/actor.ts: prefer a matching event sender.type over the Users API; the API stays as the fallback.
• test/actor.test.ts: pin the labeled / workflow_dispatch skip-API paths, bot allow/deny, and the mismatch + senderless fallbacks.

Fixes #1348.