Add trusted GitHub actor allowlist

.agents/trusted-github-actors.yml

@@ -0,0 +1,27 @@
+# GitHub actors whose public issue/PR/review comments may be acted on by
+# PR-batch automation. Keep this list deliberately strict: unknown actors are
+# queued for maintainer triage, not interpreted as instructions.
+trusted_users:
+  - justin808
+
+# Bot entries are base bot names. GitHub API logins usually include the
+# `[bot]` suffix; humans with the same base login are not trusted by this list.
+# Trusted bots are exempt from hidden-participant blocking, so keep this list
+# limited to bot identities whose generated PR content is safe to process.
+trusted_bots:
+  - chatgpt-codex-connector
+  - claude
+  - coderabbitai
+  - cursor
+  - dependabot
+  - greptile-apps
+  # Current use is limited to the deterministic Cloudflare Pages preview
+  # comment in `.github/workflows/site-build-deploy.yml`. Do not add new
+  # `GITHUB_TOKEN` comment workflows without a distinct bot/app identity or a
+  # matching provenance check in the batch preflight tool.
+  - github-actions
+
+# Team entries are GitHub team slugs under the repository owner org. Reading
+# team membership requires the local GitHub token to have org access.
+trusted_teams:
+  - shakacode