fix(ci): authorize Repo Owners for visual acceptance

[cixzhang]

Why

GitHub's collaborator-permission endpoint reports repository owners as top-level permission: write with role_name: Repo Owner, while effective capabilities live under user.permissions. Reading user.permission therefore refused every decision, and treating top-level write as authority would admit ordinary writers.

#5591 restored effective maintain/admin authorization. This follow-up preserves the endpoint's permission and role, adds the exact repository-owner fallback, and keeps old acceptance records valid.

A live authorized replay then exposed a second blocker: the archive job has no package install, but visual-acceptance.mjs eagerly imported pngjs before running the dependency-free accept path.

What

• Parse the documented endpoint shape once: effective maintain/admin or exact Repo Owner succeeds; ordinary write, unknown, and 404 identities fail.
• Archive both the reported permission and role without consulting author_association.
• Keep old maintain/admin acceptance records valid.
• Load pngjs only for post-merge pixel comparison, so the read-only authorization and archive path need no dependency install.
• Preserve the trusted default-branch checkout and publisher boundary from #5588.

Risk

Low. Authorization remains fail-closed and does not admit general write access. The lazy dependency load is covered by running acceptance from an isolated copy with no node_modules.

Testing

• Full visual-gate Vitest suite: 14 files, 135 tests
• actionlint .github/workflows/visual-acceptance.yml
• pnpm check:repo
• Exact #5162 artifact dry-run against head 66ef14d69ed5f32c469c78cb2e8395bfe23ec633, run 33041576630/2
• Full CI on the exact PR head

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
astryx	Ready	Preview	Aug 27, 2026 7:33am

[github-actions]

PR Analysis Report

📚 Storybook Preview

View Storybook for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

🧪 Sandbox Preview

View Sandbox for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

No new or modified components detected.

Bundle Size Summary

No component packages changed.

Accessibility Audit

Status: No accessibility violations detected.

---

_{Generated by PR Enrichment workflow | Storybook | Sandbox | View full report}

[cixzhang]

Can't approve my own PR, so: semantic approve. The Repo Owner boundary, dependency-free acceptance, record compatibility, and workflow permissions all pass.

[Reviewed by Robohands]