The crew takes direction only from people who can write: a reader's comment never steers or starts a run #619

On a public repository anyone with an account can comment. Today a comment or a commenting review from any signed-in person on an agent's open issue or pull reaches the crew: it is either passed into the running agent as its next turn, or it queues a follow-up run. Neither checks whether the person can write to the repository. A public repository must not let a reader direct the crew, spend the owner's budget, or put words into a run that holds a write token.

Acceptance criteria

• [ ] In src/crew/dispatch.ts, the comment and review routes steer or queue a run only when the actor can write to the repository (canWrite), or is the crew's own reviewer as today. Everyone else's words stay on the thread and do nothing more.
• [ ] The same rule applies wherever a run's prompt quotes the conversation: text from someone who cannot write is either left out or clearly marked as untrusted input from a reader, never as an instruction.
• [ ] Assignment, the steering box on a run page and /tell keep their existing writer-only rule. A test proves each one refuses a reader.
• [ ] Tests: on a public repository, a reader's issue comment, pull comment and commenting review on an agent's open issue (a) do not call steerRun, (b) queue no run, and (c) still appear on the thread. A writer's comment still does both, as today.
• [ ] The run page and thread say plainly that only people who can write here direct the crew.

Additional acceptance criteria. The issue body cannot be edited through the API, so they are added here, and they are part of this issue.

• [ ] One rule, in one place, decides whether an actor may trigger the crew on a repository: they can write to it (canWrite), or they are the crew's own reviewer as today, or the owner turned on an explicit per-repository switch, "outsiders may trigger the crew". The switch defaults to off, and turning it on is recorded in the audit.
• [ ] An outsider's comment is recorded on the thread and never reaches an agent: no steerRun, no queued run. This also covers an unassigned pull that an agent authored, which today falls back to its author in agentFor.
• [ ] Every other path that queues an agent run applies the same rule: the MCP converge tool (today it checks only read access and token scope), tell, assignment, the steering box, and converge over HTTP. A test proves that each one refuses a reader.
• [ ] Test with a non-member account on a public repository with crew: comments and commenting reviews start and steer nothing. With the switch on, they queue a run.

Interim mitigation since 2026-10-05: agents were unassigned from open issues on public repositories, and agent pulls were handed to the owner. The list to restore is in /data/steward-unassigned-public-2026-10-05.json. Restore it after this lands.

Confirmed: the MCP converge write-access check is part of this issue (see the comment above). Interim mitigation since 2026-10-05: the builders vesper and torque were removed from trevato/cs-engine's crew, so no public fork has a builder. They are recorded under crew in /data/steward-unassigned-public-2026-10-05.json. Restore them after this lands.