fix(ci): App-free rerun commands at contributor tier, with fork /rerun-test under label approval

[guapisolo]

Summary

Make the PR-comment commands /rerun-test <test-file> and /rerun-failed-ci work out of the box — no GitHub App, no CI_COMMAND_APP_* setup — at contributor tier instead of write, for same-repository and fork PRs alike. Label commands are CI policy and keep both their App requirement and their write gate.

Motivation

The point of /rerun-test is to let anyone iterating on a PR run one targeted test instead of burning a full CI pass. As shipped, the gateway sat behind a three-piece App setup for every command and required live write permission — so in practice nobody could use it, and the people who need it most (external contributors, whose PRs are necessarily forks) were structurally excluded.

Design constraints this PR encodes:

1. The App is only irreplaceable for labels. A label added with GITHUB_TOKEN never fires the pull_request(labeled) CI workflows (GitHub's recursion guard). A file run starts through workflow_dispatch — a documented exception to that guard — and a failed-job rerun is a new attempt of an existing run, not a new event-triggered run. Neither needs the App.
2. A fork head is the normal shape of a non-write contributor's PR — pushing a same-repository branch already requires write. So the policy tier (prior contributor or live write) is the whole gate for both head shapes; fork adds containment, not approval.

Changes

File	Change
.github/workflows/comment-ci-command.yml	Actions capability + 👍/reply feedback jobs run on the workflow's own GITHUB_TOKEN with job-scoped permissions (actions: write + pull-requests: read; issues: write for feedback). App mint remains only in the issues (label) path; a label command posted while the App is not enabled fails loudly instead of skipping silently.
.github/workflows/policies/comment-command-access.json (v3)	New prior_contributor_access group (OWNER/MEMBER/COLLABORATOR/CONTRIBUTOR via the comment's author_association, else live write/admin) owns both run_test_file and rerun_failed_ci. add_label/clear_labels stay write/admin. First-time contributors and unknown users are denied.
.github/workflows/scripts/comment_ci_command.py	Policy schema v3 validation; parse_event extracts and validates author_association; require_access admits an allowed association before the live-permission lookup. Fork /rerun-test runs the same policy gate as same-repo, plus the fork head identity is re-verified against its unique open PR before dispatch.
.github/workflows/run-ci-file.yml	The trusted resolver derives fork-ness from the live PR (never from a dispatch input); fork runs receive no repository secrets — WANDB_API_KEY (CUDA) and HF_TOKEN (CPU) are withheld, matching the pr-test fork policy.
docs/ci/05-command-identity.md (new)	Owns comment-command identity end to end: event identity bindings, the three access groups, the explicit tier constraints (labels = CI policy; rerun = runner time, not code trust; fork = the normal non-write contribution shape, so the tier is the whole gate), evaluation points, and per-command token identity. Registered in docs.json navigation.
docs/ci/01-label.md	Keeps command behavior and the enablement runbook (now label-commands-only; App grant drops Actions: write); authorization moved to Command Identity.
tests	Handler suite grows to 241 tests (fixtures carry author_association; new coverage: contributor dispatch without permission lookup on both head shapes, first-timer denial, association not leaking to label commands, fork head-identity verification, secret-withholding workflow invariants, fail-closed invalid association).

Authorization matrix

Commenter	/rerun-test (same-repo or fork)	/rerun-failed-ci	/run-ci-*, /clear-labels
write / admin	✅	✅	✅ (App required)
prior contributor (merged commit)	✅	✅	❌
first-time contributor / no history	❌	❌	❌

Security posture

• A failed-job rerun re-executes an already-authorized run with its original privileges and SHA — granting it to contributors adds runner time, not code trust. Held (action_required) runs are never selected for rerun.
• Fork file runs execute fork code on suite runners, gated by the contributor tier; containment: no repository secrets (fork-ness derived server-side from the live PR, so a forged dispatch input cannot reclaim them), head identity pinned to its unique open PR, one registered file, max(1800, est*1.25)s timeout, per-PR queued serialization.
• The command App token, when the label path is enabled, is scoped to Issues: write only and never reaches the jobs that execute PR code.

Verification

• tests/ci/test/test_comment_ci_command.py: 241 passed; tests/ci/test/test_file_run.py: 21 passed; black 24.3.0 clean; YAML and docs.json parse.
• Not verifiable before merge: issue_comment workflows run only from the default branch. Post-merge validation steps are kept in docs/ci/01-label.md (/rerun-failed-ci on a disposable failed run, then /rerun-test with one registered CUDA file; for the fork path, one fork PR commented by a prior contributor, confirming the dispatched run shows empty WANDB_API_KEY).
• Residual risk: fork-head checkout in run-ci-file.yml fetches the bare PR head SHA from the base repo (reachable via refs/pull/N/head); if a fork force-pushes it away before the run starts, the run fails loudly at checkout.

🤖 Generated with Claude Code

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[guapisolo]

quick merge this to unblock