ci: only auto-run release-QA for org members / collaborators

Gate dispatch-release-qa on author_association (OWNER/MEMBER/COLLABORATOR) so an outside
contributor's PR can't spend the single hardware lab. Combined with the existing same-repo (non-fork)
check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Eric Migicovsky <eric@repebble.com>

Author: Eric Migicovsky

.github/workflows/build-firmware.yml

@@ -201,10 +201,14 @@ jobs:
   # only (forks have no secrets); needs UNICORN_DISPATCH_TOKEN — a PAT with actions:write on unicorn.
   dispatch-release-qa:
     needs: build-qa-firmware
+    # Org members / collaborators only: author_association is MEMBER for org members, OWNER for the
+    # repo owner, COLLABORATOR for added collaborators — external contributors (CONTRIBUTOR/NONE) are
+    # excluded, so an outside PR can't spend the hardware lab.
     if: >-
       github.event_name == 'pull_request' &&
       needs.build-qa-firmware.result == 'success' &&
-      github.event.pull_request.head.repo.full_name == github.repository
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)
     runs-on: ubuntu-24.04
     # One in-flight QA per PR: a newer push supersedes the older dispatch instead of queueing extras.
     concurrency: