fix(settle-tier4): accept admin collaborator settlements

[an0mium]

Summary

• Treat trusted COLLABORATOR settlement comments like MEMBER comments when live repo admin permission verifies the login.
• Keep non-admin collaborators rejected.
• Add regression coverage for admin collaborator acceptance, non-admin collaborator rejection, and settle-only/check trust consistency.

Validation

• python3 -m pytest tests/scripts/test_settle_tier4_pr.py
• git diff --check

Notes

• Does not merge or mutate PR fix(settle-tier4): preflight branch protection before merge apply #8392.
• Root cause observed: GitHub reports trusted/admin settlement comments as COLLABORATOR, while settle_tier4_pr.py --check only treated OWNER and admin MEMBER as trusted.

[github-actions]

Aragora Code Review

Advisory-only review. No issues found.

[an0mium]

Closing as a duplicate of #8412 (consolidating the settle_tier4_pr.py admin-COLLABORATOR-trust fix to one PR to stop the file's merge-conflict churn).

Both PRs solve the same root cause — on the org-owned repo, admin operators show authorAssociation=COLLABORATOR, which --check rejected. They differ on the trust boundary, and #8412 has the safer one:

• This PR (fix(settle-tier4): accept admin collaborator settlements #8408) folds COLLABORATOR into the existing MEMBER rule, so with no ARAGORA_TIER4_TRUSTED_OPERATORS allowlist configured, any admin collaborator is trusted — it fails open.
• fix(tier4): accept trusted admin collaborators #8412 keeps COLLABORATOR as a separate, stricter association: it authorizes only when the login is on the explicit allowlist and has live admin permission; with no allowlist it rejects — it fails closed. It's also based on post-fix(tier4): fall back to REST when GraphQL is exhausted #8399 main (mergeable clean) and adds a REST-endpoint regression test for the admin check.

For a Tier-4 merge-authority boundary, fail-closed-when-unconfigured wins, so #8412 is the keeper. The one thing worth porting from here is the policy-rationale comment on the trust constant.

No functionality is lost by closing this; #8412 supersedes it.

---

Generated by Claude Code

[scarmani]

Closing as duplicate/superseded by merged PR #8412. The prior thread already recorded why #8412 is the keeper: it implements the admin-COLLABORATOR Tier-4 settlement fix with the fail-closed allowlist/admin-permission boundary, while this draft trusts admin collaborators more broadly. #8412 merged at c8f9cfa and current main contains the stricter COLLABORATOR allowlist checks. This closes queue residue only; no settlement, merge, or branch-protection mutation is being performed.