Enforce vetted issue revisions before authority automation

[rmcdaniel]

The organization issue-authority workflow currently lets every issue event reach an environment-backed audit that scans public issue bodies with a write-capable cross-repository token. An externally authored issue must remain inert until a trusted maintainer approves its current revision.

Goal

Make GitHub issue intake reconstructable and fail closed without allowing arbitrary issue text, edits, or comments to drive privileged automation.

Acceptance criteria

• Issues authored by rmcdaniel or durable-workflow-ops are trusted at creation.
• Any other author requires intake:approved most recently applied by one of those identities after the latest title or body edit.
• Removing the label or editing the title/body invalidates the current approval; reapproval binds a new immutable revision digest.
• Unapproved issue events cannot enter an environment, receive a write-capable token, mutate authority state, or have their body interpreted by automation.
• Comments, pull-request text, logs, artifacts, and attachments are never issue instructions.
• Read-only discovery and write-capable lifecycle credentials are separate and least-privileged.
• The authority policy provisions intake:approved across the complete public repository inventory.
• Automated tests cover trusted creation, external creation, trusted and untrusted label actors, post-approval edits, label removal, and clean-machine reconstruction.

[rmcdaniel]

Required operational evidence passed in Beta candidate run 30076808112.

Verified push execution on main at 6e6e28b4a838 contains landed source b6085ffca2fc.

[rmcdaniel]

Completed in b6085ffca2fc on main.

Required public qualification passed: https://github.com/durable-workflow/.github/actions/runs/30076808112