[no-ci] CI: stop trusting public read permission in restricted paths guard

[rwgk]

Reference: #2104

Summary

This PR fixes the restricted-paths guard trust check so public repository read permission is no longer treated as a collaborator/trust signal.

The guard now:

• queries the live pull request API for author_association on restricted-path PRs
• trusts live MEMBER and OWNER author associations
• falls back to the collaborator permission API only when the live author association is not trusted
• trusts collaborator permissions triage, write, maintain, and admin
• treats collaborator permission read as untrusted, because public repositories can report read for any GitHub user

Background

Earlier versions of restricted-paths-guard.yml used github.event.pull_request.author_association from the workflow event payload. That value turned out to be stale or unreliable for some fork PRs, so PR #1930 switched the workflow to the collaborator permission API.

PR #2010 later expanded the trusted collaborator permissions to include read, after seeing a false positive for an internal/collaborator author whose permission was reported as read.

Issue #2104 captures the follow-up discovery: on a public repository, the collaborator permission API can return read for users who are not repository collaborators. For example, a first-time external contributor can get effective read access simply because the repository is public.

This PR keeps the useful part of the previous workaround, but tightens the trust model:

• live author_association is queried from GET /repos/{owner}/{repo}/pulls/{pull_number} instead of using the event payload
• read from GET /repos/{owner}/{repo}/collaborators/{username}/permission is no longer trusted

Testing via reverted temporary commits

• 5ede772 — TEMPORARY: Switch to pull_request trigger for testing
• 5226846 — TEMPORARY: Exclude write permission from trusted collaborators

[leofang]

Trust model tightening looks correct and well-reasoned. Walked through the key edge cases (org MEMBER with read-only perm, outside COLLABORATOR with write, FIRST_TIME_CONTRIBUTOR) — all handled properly by the two-tier check. One minor inline note, otherwise LGTM.

[rwgk]

Thanks @leofang!

[rwgk]

Tested via this dummy PR:

• [no-ci][DO NOT MERGE] DUMMY CHANGE: cuda_bindings/pyproject.toml #1895 (comment)

The workflow worked as intended:

• https://github.com/NVIDIA/cuda-python/actions/runs/26128203440

Copy-pasting the Summary view:

---

Restricted Paths Guard Completed

Author: rwgkunplugged

Author association: NONE

Collaborator permission: read

Touches restricted paths: true

Restricted paths: cuda_bindings/, cuda_python/

Trusted signals: (none)

Label action: added

Comment action: posted

Matched restricted paths:

cuda_bindings/pyproject.toml

Manual follow-up: No trusted signal was found, so Needs-Restricted-Paths-Review is required.

[github-actions]

Doc Preview CI
Preview removed because the pull request was closed or merged.