Phase 4: only allowed runners green-light a branch

Phase 4: only allowed runners green-light a branch

Signing made a result attributable; this makes the attribution matter. A required
check is a claim about a commit, and until now any admin of the repository could
satisfy it — which is exactly the party the check exists to constrain.

`acl.runners` is an allowlist of the accounts whose CI results count for a
repository, and the gate's rule is: a green run counts only when its attestation
names an account on that list. Admins are implicit, because they can rewrite the list
and a protected branch already lets them land anything with no checks at all — so the
list is about everybody else. A writer running CI on their laptop gets their result
recorded and not counted, and the run page says which, so the answer to "why is my
green run not gating?" is where somebody looks for it rather than only in a refusal.

It is deliberately not a role. Read/write answers "may this account touch the
repository"; this answers "may this account's build be believed about it", and
conflating them would make every writer trusted about builds.

The same list decides who may lease a job, since running one executes the
repository's code: the answer arrives before the build rather than after it. That
also loosens the old lease rule, which required admin — a named runner needs no
write access at all.

`vole acl runners <repo>` shows the list, bare names replace it, `+name` adds, and
`none` clears it. There is no `-name`: revoking trust is the operation where being
made to state the whole list is a feature, and the list is printed after every change
so a dropped name is visible at once.

Fixed on the way: the new "skip non-successful runs" test would have dereferenced a
nil run for the no-run case, which TestMissingRunBlocksWithAHint caught as a panic in
the hook rather than a message.

Verified: TestOnlyAllowedRunnersGreenLightABranch walks the whole rule — an unlisted
writer is given no work, and the run page and the refusal both explain it; naming them
a runner lets them lease, run and report (attested to them); revoking the runner
refuses the merge naming the account and the command that would allow it, with the run
page saying "does not count as a check"; allowing them again lets the same green
result land, with nothing else changed.
TestACLRunnersEditsTheList covers show, +add, replacement and the unknown-account
refusal. internal/acl tests pin the rule itself: admins implicit, listed accounts
count, read-only accounts do not, and an empty account never does; plus list
normalisation and the round trip through the ref it is stored on.
scripts/ci.sh green (gofmt, vet, build, markdown links, go test -race ./...).