fix(github): lead with the database's operators on command-rejection comments

[aparajon]

Why this matters

When a PR command is rejected as not authorized, the comment lists who can run it — but as one flat list where the database's own operators (the people the requester should actually ask) can end up buried behind the global admin principals. The review-required comment already solved this ordering; the rejection comment should read the same way.

What it does

• Splits the authorized-principals lookup into the database's operators and the broader admins, deduped so a principal configured in both groups is listed only as an operator.
• The rejection comment now leads with an Operators of <database> section, followed by Other authorized teams and users, and closes with what to do next (ask one of them, or request team membership). A database with no configured operators keeps a single flat list.
• Principals still render as inline code, never @-mentions, so a rejection never notifies every admin.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Improves the UX of PR command authorization rejection comments by surfacing the target database’s operators first (so the requester knows who to ask), while still listing broader admins as an explicit fallback and avoiding @-mentions.

Changes:

• Split the authorized-principals lookup into OperatorPrincipals vs OtherPrincipals, with cross-group dedupe.
• Update the rejection comment renderer (and preview) to lead with an “Operators of <db>” section when operators exist.
• Update and expand unit tests and the templates documentation example to reflect the new ordering/format.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
TEMPLATES.md	Updates the rendered example of the “not authorized” comment to show operators-first formatting.
pkg/webhook/templates/preview.go	Updates preview data to pass operator vs other principal groups.
pkg/webhook/templates/apply_commands.go	Renders operators-first rejection comments; introduces writePrincipalList helper.
pkg/webhook/templates/apply_commands_test.go	Adjusts tests to validate operators-first sections and ordering.
pkg/webhook/actor_authorization.go	Passes operator vs other principal groups into the rejection comment.
pkg/api/actor_authorization.go	Changes config API to return (operators, others) with dedupe behavior.
pkg/api/actor_authorization_test.go	Updates tests to validate grouping, ordering, normalization, and dedupe semantics.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[morgo]

🤖 Approving on Morgan's behalf (automated review, escalation rules apply).

Verified the authorization decision path is untouched — PRCommandAuthorizedPrincipals feeds only the rejection comment, and the enforcement gate above it is unchanged. The split into (operators, others) keeps the same normalization and cross-group dedup (shared seen map), with operators processed first so a dual-configured principal lists once, as an operator. Template handles all three shapes (both groups / others only / neither) with the old fallback sentence preserved, keeps the no-@-mentions invariant, and only offers "request membership" when a team is actually listed — all tested, including ordering assertions.

One cosmetic side effect worth knowing: dedup priority flipping means the operator-configured casing of a principal now wins over the admin-configured casing in the rendered list (the normalization test captures this). Display-only.