ci: trigger SeekDB CI from trusted comments

[hnwyllmm]

Summary

• trigger SeekDB CI only when a pull request Conversation comment is exactly /test
• authorize the comment author with GitHub's repository-permission API and require write or admin
• rely on effective repository permission, which already includes access granted through teams; no team lookup or extra PAT is required
• allocate the internal runner only after authorization succeeds
• test refs/pull/<number>/merge and verify the fetched commit matches the exact merge SHA returned by GitHub
• report SeekDB CI / mysqltest as pending, success, or failure on the tested merge commit
• keep scheduled runs automatic and retain manual/reusable workflow entry points
• grant statuses: write only to the two GitHub-hosted status-reporting jobs

Usage

Post this exact comment in the pull request Conversation:

/test

Only users whose effective repository permission is write or admin can start the internal CI jobs. Comments on issues, comments with other text, draft pull requests, closed pull requests, and pull requests targeting branches other than master or develop are rejected or skipped.

Validation

• git diff --check
• actionlint v1.7.12 passed, excluding the existing custom runner-label warning
• all three actions/github-script blocks parsed successfully
• authorization branches exercised with mocked write, read, draft, develop, and scheduled inputs
• pending/success/failure commit-status payloads exercised with mocks
• GitHub serves the updated branch workflow with the issue_comment trigger
• live PR refs/pull/1337/merge fetched over the same SSH remote and matched GitHub's merge_commit_sha exactly
• PR CodeQL and CLA checks passed after the update

The issue_comment event reads workflow configuration from the default branch, so the end-to-end /test trigger becomes testable only after this PR is merged.