Gate PR previews with OWNERS and add direct review comments

[jonabur]

Make preview links visible directly in PR conversations and require authorization before publishing PR JavaScript on the dashboard's origin.

OWNERS initially contains jonabur and spyysalo. Their PRs deploy automatically after checks pass. For other authors, the bot explains why deployment is blocked and provides a complete, copyable /deploy <40-character-commit-sha> command. Only a command from a current OWNER approving that exact commit grants access; later pushes require new approval. The publisher reads OWNERS from its trusted default-branch checkout, so a PR cannot authorize itself. Approval comments are checked on every reconciliation, including after coalesced workflow events. A rocket reaction acknowledges a deployed approval. Reactions alone do not authorize deployment.

The bot creates one comment per PR with Open preview, the built commit, or approval instructions. It updates its own marked comment and leaves unchanged text and human comments alone. A previously approved preview remains available while a new commit awaits approval or passing checks. Revoked previews are removed on reconciliation. Closing a PR marks its existing comment Preview closed after the page is removed, with cleanup retained across deployment/reporting retries.

Ordinary comments never enter the deployment queue. Only the trusted publisher receives pull-requests: write; PR builds retain read-only access. This gate authorizes browser code—it does not sandbox it. Previews still share the main dashboard's origin.

Validation:

• python3 -m tests.check passes, including the public browser suite.
• Regressions cover owner validation, exact-commit approvals, forged/partial/quoted commands, new pushes, revocation before artifact download, retained approved snapshots, bot comment creation/reuse, cleanup retries, pagination, and reaction acknowledgments.
• actionlint passes for both workflows.
• Read-only rehearsal against current GitHub artifacts confirms that PRs by the two initial owners remain eligible.