Ready issues must be written and labelled by a Trusted account #667

This was generated by AI during triage.

Private record: https://github.com/JacobStephens2/thirdshift/security/advisories/GHSA-h8pg-c4fm-fhw5

What to change

Add one rule for a Trusted account on a repository: its owner, a member of the organization that owns it, or a collaborator on it (authorAssociation of OWNER, MEMBER or COLLABORATOR, or the equivalent repository permission for an actor that has no association field). Define the term in CONTEXT.md. The rule is fixed for now, with no User config setting.

An issue is a Ready issue only if a Trusted account wrote it and the most recent ready-for-agent label event on it was made by a Trusted account. An issue that fails either check is passed over, with a line that names which check failed. A Spec run makes the same check on each Ticket before it starts that Ticket's Run, and stops with an error instead of starting one that fails. A Run started directly on an Issue URL prints a warning: line when the issue fails the check, then carries on.

Acceptance criteria

• A ready-for-agent issue written by an account with no association to the repository is passed over, with a line that names why.
• An issue whose most recent ready-for-agent label was applied by an account that isn't trusted is passed over, with a line that names why.
• A Spec run doesn't start a Ticket that fails the check.
• A Run started on an Issue URL that fails the check warns and still runs.
• Base fix and Security fix issues that thirdshift files itself still pass.
• Architect and Security runs, which share the Ready issue search, are skipped only by issues that pass.

Out of scope

• A User config setting for who is trusted.
• Edits after labelling, and issue comments (separate issues).