feat(e2e): authorize fork comment checks

[vcauesantos]

Summary

• add opt-in fork support to comment-triggered-check
• require write, maintain, or admin permission before a commenter can approve fork code
• add a queue/resolve handoff for a native pull_request workflow
• keep fork support disabled by default

Security

The privileged issue_comment workflow never checks out fork code. For an approved fork request, it records the parsed command and toggles an internal label with a GitHub App or PAT token. A pull_request: labeled workflow accepts only the trusted bot's request for the pull request's exact head SHA.

This preserves the normal pull request cache scope and avoids dispatching the base branch before checking out fork code.

Testing

• make test-comment-triggered-check (188 passed)
• shellcheck -x .github/actions/comment-triggered-check/src/*.sh
• make check-docs

Part of DEVOPS-1541.

After merge, comment-triggered-check/v1 must be advanced before the caller PRs can merge.