refactor(github-app): extract a shared withAuthorizedPrAction scaffold for action commands

[JSONbored]

Surfaced by the #538 analysis. maybeProcessPrPanelRetrigger and the new maybeProcessGateOverrideCommand (#538) share ~80% boilerplate: resolve real repo permission → authorize → load PR/settings → build advisory → audit → product-usage. As #778 (auto-maintain) adds more action commands (auto-merge/close/request-changes), this duplication is a consistency + safety risk (each new action command must independently get the real-permission auth right).

Deliverable

• Extract a withAuthorizedPrAction({ commandName, payload, onAuthorized }) helper in src/queue/processors.ts (or a sibling module) capturing: real-permission resolution (resolveRealRepoPermissionAssociation), isAuthorizedCommandActor, the deny audit/product-usage, the advisory build, and the success audit shell.
• Refactor maybeProcessPrPanelRetrigger + maybeProcessGateOverrideCommand onto it (no behavior change; tests stay green).
• Future action commands (feat(agent): maintainer write-actions layer (request-changes/approve/merge/close/label) #778/roadmap(agent phase 1): maintainer auto-maintain (cloud action layer) #769) build on it.

Why it matters

Centralizes the real-permission authorization so no future action command can accidentally fall back to the spoofable author_association (the #788 hazard). Relates #778, #769, #788, #538.

Context

src/queue/processors.ts (maybeProcessPrPanelRetrigger ~1432, maybeProcessGateOverrideCommand new), resolveRealRepoPermissionAssociation.