Check collaborator permissions for workflow_run events (#1590)

The write-permission gate previously only ran for issue/PR entity
events. Apply it to workflow_run events as well, checking both the
workflow actor and the actor recorded on the upstream run when they
differ. allowed_non_write_users and the github_token override behave
the same as for entity events. Document the behavior for workflow_run
pipelines.

test/github-context.test.ts

@@ -33,6 +33,7 @@ import {
   isIssuesAssignedEvent,
   isEntityContext,
   isAutomationContext,
+  isWorkflowRunEvent,
 } from "../src/github/context";
 import { CLAUDE_APP_BOT_ID, CLAUDE_BOT_LOGIN } from "../src/github/constants";
 import { createMockContext, createMockAutomationContext } from "./mockContext";
@@ -517,4 +518,14 @@ describe("type guards", () => {
     ).toBe(true);
     expect(isAutomationContext(issuesContext)).toBe(false);
   });
+
+  test("isWorkflowRunEvent accepts only workflow_run", () => {
+    expect(
+      isWorkflowRunEvent(
+        createMockAutomationContext({ eventName: "workflow_run" }),
+      ),
+    ).toBe(true);
+    expect(isWorkflowRunEvent(workflowDispatchContext)).toBe(false);
+    expect(isWorkflowRunEvent(issuesContext)).toBe(false);
+  });
 });