fix: check allowed_bots before API call in checkHumanActor

[Dave-London]

Summary

• Moves the allowed_bots check (wildcard * and specific bot list) before the octokit.users.getByUsername() API call
• Prevents 404 crashes for bot actors like github-merge-queue[bot] that don't have regular GitHub user profiles
• Adds 3 new tests covering the 404 scenario

Problem

checkHumanActor calls octokit.users.getByUsername() as its first action. Bot accounts like github-merge-queue[bot] return 404 from this API, causing the function to crash before the allowed_bots configuration is ever checked. This makes allowed_bots ineffective for scheduled/cron workflows and any bot-triggered events.

The GitHub workflow-level guard runs successfully, but the action fails with:

##[error]Prepare step failed with error: Not Found - https://docs.github.com/rest

Changes

• src/github/validation/actor.ts: Reordered to check allowed_bots (wildcard and specific list) before making the API call
• test/actor.test.ts: Added 3 tests with a mock that throws 404, verifying allowed bots bypass the API call

Test plan

• All 10 actor tests pass (bun test test/actor.test.ts)
• TypeScript typecheck passes (bun run typecheck)
• Prettier formatting passes (bun run format:check)

Fixes #900