Check collaborator permissions for workflow_run events

[ashwin-ant]

Summary

• The write-permission check in run.ts only ran for entity events (issues, PRs, comments, reviews), so workflow_run-triggered runs skipped it entirely and went straight into agent mode. This applies the same collaborator permission check to workflow_run events, so behavior matches what docs/security.md describes.
• For workflow_run, both the workflow actor and the actor that started the upstream run (payload.workflow_run.actor.login) are checked when they differ. allowed_non_write_users, github_token, and [bot] actors behave exactly as they do for entity events.
• workflow_dispatch, repository_dispatch, and schedule are unchanged — GitHub already requires write access to dispatch, and schedules have no external actor.
• checkWritePermissions now accepts any GitHubContext; entity-context behavior is unchanged (single actor).
• Docs updated to describe the workflow_run check and the allowed_non_write_users opt-in.

Behavior change to be aware of

Workflows that run this action on workflow_run where the upstream run was started by someone without write access (e.g. CI on a pull request from an outside contributor's fork — see examples/ci-failure-auto-fix.yml / examples/test-failure-analysis.yml) will now stop with "Actor does not have write permissions to the repository" instead of proceeding. Repos that want the previous behavior for those contributors can add them via allowed_non_write_users (with github_token: ${{ secrets.GITHUB_TOKEN }}).

Test plan

• bun test (814 pass) — new cases for read-only run actor rejected, write/admin allowed, differing workflow vs run actor both checked, allowed_non_write_users with/without github_token, [bot] run actor
• bun run typecheck
• bun run format:check

[claude]

Warning

This review may be incomplete: some analysis steps could not run due to a temporary API capacity limit.