ci: require accepted issues for community pull requests

[elezar]

Summary

Require community pull requests to link OpenShell issues marked state:accepted, while allowing authors with verified repository write access to proceed without that label. Report acceptance through the native OpenShell / PR Issue Acceptance Actions job, including fork PRs and drafts, and prevent PR body text from granting an exemption.

Related Issue

Closes #4339

The issue does not have state:accepted; the submitting author's verified repository admin access permits this PR under the maintainer exception.

Changes

• Add a pull_request_target workflow that loads trusted base code and runs the CJS check alongside the existing maintainer-check scripts in tasks/scripts/.
• Extend feat(ci): gate merges on maintainer approval via a required status check #3176’s CODEOWNERS protections to the acceptance script and tests, and suppress only this workflow’s reviewed pull_request_target trigger in Zizmor. Native required code-owner review must be enabled for ownership to enforce approval.
• Check the PR author's upstream repository permissions, require at least one accepted issue for other authors, and reject unaccepted or cross-repository issue links.
• Use the native workflow job result instead of publishing commit-scoped statuses, and remove statuses: write. Lookup errors propagate to the job, including a failed PR refresh; checkout and script-loading failures also fail the job. Neither No issue required nor the triggering actor's permissions bypasses acceptance.
• Add regression tests and align the PR creation and review skills, build skill, contributor guidance, and PR template with the acceptance gate while preserving current main's issue-linking and verification conventions.
• Have PR reviews identify linked issues missing acceptance, verify the author’s upstream access, and distinguish maintainer exemptions from community gate violations.
• Issue-label changes require a rerun; closing-reference detection assumes the default branch. Required-status settings, Actions event policy, and merge-queue support remain separate work. Automated dependency PRs receive no additional acceptance exemption.

Testing

• Checks appropriate to the affected code and behavior pass: mise run pre-commit, Actionlint and offline Zizmor for the acceptance workflow (the three workflows were also checked before rebasing), skill validation, inventory and architecture cross-reference checks, trusted workflow wiring, and git diff --check.
• Unit tests added/updated: node --test tasks/scripts/check_issue_acceptance.test.cjs — all 16 pass, covering independent evaluations for shared-head PRs, failed refreshes after success, and PR/issue/label lookup failures; the 19 maintainer-helper tests also pass after integrating feat(ci): gate merges on maintainer approval via a required status check #3176.
• E2E tests added/updated (if applicable): not applicable to this repository contribution workflow.

mise run ci was attempted but stopped during Rust test linking with ld: library 'z3' not found in openshell-prover-cli. This PR changes no Rust code. Hosted verification of this workflow, including two PRs sharing a head commit and fork behavior, remains pending: it requires a sandbox default branch or deployment of the trusted workflow and script. Local shared-head regression tests exercise independent evaluations, not GitHub's check association.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable): not applicable; no product architecture changes.

[johntmyers]

overall this lgtm just gotta get zizmor happy (prob safe to ignore the one finding?)