fix: handle 404 errors in checkWritePermissions for non-user actors

[MaxwellCalkin]

Summary

Fixes #1018

checkWritePermissions calls octokit.repos.getCollaboratorPermissionLevel() with github.actor as the username. When the actor is a non-user entity like Copilot (from a Copilot-initiated pull_request_review), this API returns a 404 because Copilot is not a regular GitHub user.

The existing bot bypass only checks for actors ending in [bot], but Copilot does not follow that naming convention.

Changes

• src/github/validation/permissions.ts: Added 404 error handling in the catch block. When the collaborator permissions API returns a 404 (indicating the actor is not a GitHub user), the function now logs an informational message and returns true instead of throwing. Non-404 errors continue to throw as before.

• test/permissions.test.ts: Added 4 new test cases:

  • 404 from API for Copilot actor returns true
  • 404 from API for any non-user actor name returns true
  • Non-404 errors (e.g., generic Error) still throw
  • 500 server errors still throw

Why this approach

Rather than maintaining a hardcoded list of non-user actor names (which would need updating as GitHub adds new system actors), this fix catches the 404 response that GitHub already returns when an actor is not a user. This is robust against future non-user actors being added by GitHub.

This is consistent with how other parts of the codebase handle 404s from GitHub APIs (e.g., branch-cleanup.ts, update-claude-comment.ts).

Test plan

• All 17 permissions tests pass (including 4 new ones)
• Full test suite passes (19 pre-existing Windows-specific failures unrelated to this change)
• Verify with a Copilot-triggered pull_request_review workflow