fix: use repo-scoped token for pulls.get in Check if org member step

[docker-agent]

Problem

The Check if org member step passes ORG_MEMBERSHIP_TOKEN as the github-token to actions/github-script. This token only has read:org scope — it does not have repo scope.

When PR_SOURCE is trigger (the workflow_run path), the script falls into the else branch and calls github.rest.pulls.get() using that same token. Because the token lacks repo scope, GitHub returns 404, crashing the step with HttpError: Not Found.

Fix

Two minimal, targeted changes in the Check if org member step of .github/workflows/review-pr.yml:

1. Added REPO_TOKEN to the step's env block — resolves to GITHUB_APP_TOKEN (which has full repo access) when available, falling back to github.token:

   REPO_TOKEN: ${{ env.GITHUB_APP_TOKEN || github.token }}

2. Created a secondary octokit client for the pulls.get call, using REPO_TOKEN instead of the org-membership-scoped github client:

   const repoOctokit = github.getOctokit(process.env.REPO_TOKEN);
   const { data: pr } = await repoOctokit.rest.pulls.get({ ... });

The primary github client (backed by ORG_MEMBERSHIP_TOKEN) is kept exclusively for checkMembershipForUser — no other logic was changed.

Validation

pnpm lint passes cleanly: Biome CI (69 files, no issues), tsc --noEmit (no errors), actionlint (no errors).

[docker-agent]

Assessment: 🟢 APPROVE

Fix is correct and well-scoped.

The PR correctly addresses the root cause: ORG_MEMBERSHIP_TOKEN only has read:org scope and cannot call pulls.get (which requires repo scope). The fix introduces a separate repoOctokit via github.getOctokit(process.env.REPO_TOKEN) using a token with sufficient scope, while preserving ORG_MEMBERSHIP_TOKEN for the checkMembershipForUser call.

Verified:

• actions/github-script is pinned to v9.0.0 — github.getOctokit() is available ✅
• REPO_TOKEN: ${{ env.GITHUB_APP_TOKEN || github.token }} — github.token is always non-empty, so REPO_TOKEN is always populated ✅
• setup-credentials runs immediately before this step and exports GITHUB_APP_TOKEN, so the preferred high-privilege token is used when available ✅
• The ${{ env.GITHUB_APP_TOKEN || github.token }} pattern is already established in 5+ other steps in the same workflow ✅

[derekmisler]

/review