fix: remove installation requirement from trusted bot check (#26466)

* fix: remove installation requirement from trusted bot check

The installation object is not present in the webhook payload when
GitHub Apps add labels via pull_request_target events. This caused
graphite-app[bot] to fail the authorization check and fall through
to the human permission check, which doesn't work for bots.

The fix removes the installation requirement and relies on:
- sender.type === 'Bot'
- sender.login matching the trusted bot list

This is secure because the sender fields come from GitHub's webhook
payload and cannot be forged by contributors.

Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>

* chore: add extra logging about sender type

Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>

* chore: remove senderId from logging

Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>

* Update run-ci.yml

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/workflows/run-ci.yml

@@ -21,13 +21,14 @@ jobs:
             const adder = context.payload.sender.login;
             const senderType = context.payload.sender.type;
             const pr = context.payload.pull_request;
-            const installation = context.payload.installation;
+
+            console.log(`Sender: ${adder} (type: ${senderType})`);
 
             const trustedBotLogins = ['graphite-app[bot]'];
             let isAuthorized = false;
 
-            if (senderType === 'Bot' && installation && trustedBotLogins.includes(adder)) {
-              console.log(`Label added by trusted GitHub App: ${adder}`);
+            if (senderType === 'Bot' && trustedBotLogins.includes(adder)) {
+              console.log(`Authorized: trusted GitHub App`);
               isAuthorized = true;
             }
 
@@ -43,7 +44,7 @@ jobs:
                 return;
               }
 
-              console.log(`Label added by ${adder} (${perm.permission})`);
+              console.log(`Label added by ${adder}`);
             }
 
             // Find the latest pr.yml run for this PR's head SHA