viyatb-oai 9f6879944e fix: restrict bot permission bypass (#89) ...

## Summary
- stop treating every `[bot]` actor as trusted when `allow-bots` is
enabled
- add `allow-bot-users` for explicit custom bot allowlists without
wildcard support
- document bot allowlist semantics and add CLI regression tests

## Test plan
- `pnpm run check`
- `pnpm test`
- `git diff --check`

2026-04-24 17:14:19 -07:00

..

workflows

fix: restrict bot permission bypass (#89)

2026-04-24 17:14:19 -07:00