private repo 会出现 author_association 判定失败

[Terry-Mao]

Summary

• Allow CONTRIBUTOR triggers in private repos when the actor has write, maintain, or admin collaborator permission.
• Expose private-repo and repository-permission context in the PR comment workflow payload.
• Move workflow/script unittest coverage under .github/tests and update docs/codeowners for the new location.

Validation

• PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s .github/tests

Fixes #141

[github-actions]

No blocking findings. The private-repo CONTRIBUTOR authorization path is scoped to private base repositories, checks write/maintain/admin collaborator permission before enabling the response flow, and has focused unit coverage for public skip, write authorization, read denial, and lookup failure. No security findings identified.