Require fork PR approval on push unless author, head owner and pusher are all trusted; record every rerun's parent
A trusted collaborator pushing to an untrusted fork (or the reverse) no longer auto-approves CI. Full reruns now set rerun_of too, with job reuse gated on failed-only, so OIDC run_attempt counts every attempt.
6 files changed+66−6
Rendering diff…