feat: enforce virtual-collaborators allow-list in runtime flow

[heoh]

Summary

Fixes an issue where virtual-collaborators was parsed but not enforced at runtime.
When configured, only allowed VC names are used for parsing, tagging, and notifications.

Changes

• context.ts: normalize allow-list input (trim, remove empty values, dedupe)
• tag-util.ts: apply allow-list filtering to header/mention//assign and watcher resolution
• handlers: pass allow-list into watcher calculation
• tests: add allow-list + backward compatibility coverage

Verification

• npm test -- --runInBand
• npm run lint
• npm run build