Harden dev-hawk workflow_run path with explicit actor authorization gating

[Copilot]

dev-hawk.lock.yml was flagged by Runner-Guard (RGS-004) because a workflow_run-triggered path could perform privileged actions without an explicit authorization check on the upstream trigger actor. This change adds a maintainer-level authorization gate before analysis/comment behavior is allowed to execute.

• Security gating for workflow_run

  • Added explicit authorization checks for the upstream workflow actor (github.event.workflow_run.actor) before privileged steps run.
  • Restricted execution to trusted roles consistent with existing gh-aw patterns (admin, maintainer, write intent).

• Privileged step containment

  • Ensured steps that can write back (including comment-related behavior via safe-outputs) are conditionally executed only after the authorization gate passes.
  • Kept existing trigger shape (workflow_run + branch/event filters) while tightening who can activate side effects.

• Compiled workflow alignment

  • Updated workflow source/config so the compiled .github/workflows/dev-hawk.lock.yml emits the authorization guard automatically and consistently.

# representative pattern used in the workflow
if: >
  contains(fromJson('["admin","maintainer","write"]'),
           github.event.workflow_run.actor_association)

• Fixes [static-analysis] RGS-004: Comment-Triggered Workflow Without Author Authorization Check in dev-hawk.lock.yml #50189

[pelikhan]

@copilot commit and push