ccc8c2b566
This change adds a trust-check job that gates CI for external contributors: - Trusted contributors (OWNER, MEMBER, COLLABORATOR) can run CI immediately - External contributors require approval from a core team member (write access or higher) - Approval must be for the current commit SHA (stale approvals are ignored) - Added pull_request_review trigger so CI runs when approval is given - The required job now fails with a clear message for untrusted PRs Co-authored-By: Volnei Munhoz <volnei.munhoz@gmail.com> Co-authored-by: Pedro Castro <pedro@cal.com> Co-authored-by: Keith Williams <keithwillcode@gmail.com>