Require write permission for review-app deploy/delete comment commands

[justin808]

Problem

The generated cpflow-deploy-review-app.yml and cpflow-delete-review-app.yml authorize +review-app-deploy / +review-app-delete using author_association values OWNER, MEMBER, and COLLABORATOR.

Those associations are broader than repository write/maintain access: organization members and outside collaborators can hold read or triage roles. This lets a lower-permission user trigger a secrets-bearing deploy or destructive review-app deletion, even though they cannot inject code into a same-repository PR.

This was identified during the adversarial review of shakacode/hichee#9652. That PR's same-repository source guard prevents fork code from receiving secrets, so this is tracked as follow-up authorization hardening rather than a fork-secret blocker.

Proposed change

• Resolve the comment author's repository permission with GitHub's collaborator-permission API.
• Allow only write, maintain, or admin for deploy/delete comment commands.
• Fail closed if permission lookup fails.
• Keep automatic PR-close cleanup and authenticated workflow_dispatch behavior unchanged.
• Update generator specs and documentation so regenerated workflows preserve the guard.

Acceptance criteria

• A read/triage member or collaborator cannot trigger deploy or delete through an issue comment.
• A write/maintain/admin user can trigger both commands.
• Fork-source rejection still happens before repository secrets reach build code.
• Generated workflows pass actionlint and the repository workflow specs.