Gate the Claude workflow on write access, not contribution history

[ChrisJBurns]

Stacked on #6259, which is stacked on #6258. Merge in order, or rebase once those land.

Summary

• The trigger used a deny-list, and the gap was CONTRIBUTOR. It denied NONE, FIRST_TIMER and FIRST_TIME_CONTRIBUTOR — but CONTRIBUTOR is earned permanently by getting a single pull request merged, and it admitted MANNEQUIN as well. Any outside account that has landed one change could invoke the job from then on.
• The job it guards is not a low-privilege one. It holds contents: write and ANTHROPIC_API_KEY, and allows Bash(git *), driven by the text of an issue or comment. The right bar is write access to the repository, not a history of contributing to it.
• Replaced with the OWNER/MEMBER/COLLABORATOR allow-list already used by the /retest gate in retest.yaml, so there is now one idiom for "trusted enough to trigger privileged automation" rather than two.

	Allowed
Before	OWNER, MEMBER, COLLABORATOR, CONTRIBUTOR, MANNEQUIN
After	OWNER, MEMBER, COLLABORATOR

An allow-list is also the more durable shape: GitHub can add association values, and a deny-list silently admits anything new.

Part of #6253

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)

• E2E tests (task test-e2e)

• Linting (task lint-fix)

• Manual testing (describe below)

• Enumerated every value of CommentAuthorAssociation against both the old and new conditions to confirm exactly which lose access: CONTRIBUTOR and MANNEQUIN, and nothing else.

• All four event branches (issue_comment, pull_request_review_comment, pull_request_review, issues) keep their existing @claude body check and their existing association source — only the association test changed.

• actionlint is clean on the file and the workflow parses.

Does this introduce a user-facing change?

Yes, for maintainers: @claude no longer responds to people without write access to the repository. Anyone who is OWNER, MEMBER or COLLABORATOR is unaffected. If an outside contributor should keep access, the fix is to add them as a repository collaborator rather than to widen this condition.

Special notes for reviewers

• Worth confirming nobody currently relies on @claude as a non-collaborator — that is the one behavioural risk here, and it fails closed (the job simply does not run) rather than erroring.
• The checkout in this workflow still persists its credentials, unlike the ones cleaned up in Stop persisting git credentials in CI workflow checkouts #6255 and Bind workflow expressions and drop persisted credentials #6258. That is deliberate: this job has contents: write specifically so Claude can push commits to pull requests, so the credential is in use. Left alone.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.72%. Comparing base (d163115) to head (ff745e6).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6260      +/-   ##
==========================================
+ Coverage   72.71%   72.72%   +0.01%     
==========================================
  Files         742      742              
  Lines       77299    77299              
==========================================
+ Hits        56209    56218       +9     
+ Misses      17126    17119       -7     
+ Partials     3964     3962       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.