fix(ci): authorize visual acceptance by capability

[cixzhang]

Why

#5592 normalized GitHub's collaborator-permission response but still allowed the reported role name to grant authority. Role names are provenance, not a stable capability boundary. Endpoint authorization must depend only on strict effective maintain or admin booleans.

What

• Parse endpoint capabilities fail-closed: only nested admin === true or maintain === true authorizes.
• Never fall back to top-level permission when handling an endpoint response; false, strings, null, arrays, missing fields, and malformed capability data refuse.
• Keep reported permission and role as immutable-record provenance only.
• Validate legacy records in a separate trust domain: records without effectivePermission may use raw maintain or admin; legacy write fails.
• Preserve #5593's dependency install and the dependency-free accept path.
• Pin the authorization checkout invariant: trusted default-branch code with no explicit ref.

Risk

Low and fail-closed. This removes a mutable role-name authorization path without widening the accepted capability set.

Testing

• Focused authorization, acceptance, and workflow tests: 3 files, 52 tests
• Full visual-gate suite: 14 files, 149 tests
• actionlint .github/workflows/visual-acceptance.yml
• pnpm check:repo
• Exact #5162 124-frame dry-run from pre-cleanup gh-pages commit be6f3351c823f6b62c59eb29507cb4518024eacc: capability path returns success:accepted; role-only and raw-admin fallback attempts fail
• Full CI on the exact head

No live acceptance command was replayed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
astryx	Ready	Preview	Aug 27, 2026 8:30am

[github-actions]

PR Analysis Report

📚 Storybook Preview

View Storybook for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

🧪 Sandbox Preview

View Sandbox for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

No new or modified components detected.

Bundle Size Summary

No component packages changed.

Accessibility Audit

Status: No accessibility violations detected.

---

_{Generated by PR Enrichment workflow | Storybook | Sandbox | View full report}