Add a GitHub actor allow/deny guardrail to the notifications source

[polyglotAI-bot]

Summary

Adds a deterministic actor allow/deny guardrail to the github notifications source, so a deployment can restrict which GitHub logins may put a notification in front of an autonomous worker — closing the gap where any GitHub user can drive the agent simply by @-mentioning it.

The github source already fetched every login involved in a notification (issue/PR author, assignees, comment & review authors) during enrichment, but only rendered them into the record content. This surfaces them as an actors metadata key and filters on it with the existing InboxFilter engine — at ingest, before records persist to the inbox (and before the LLM / prompt-injection surface sees them).

Changes

• nerve/sources/github.py — _collect_actors(...) unions every involved login (de-duped case-insensitively, skipping empty/? placeholders); the fetch loop adds it as the actors metadata key. No new API calls — the logins are already fetched during enrichment.
• nerve/config.py — GitHubSyncConfig gains allow_actors / deny_actors.
• nerve/sources/registry.py — the github source's InboxFilter is now two ANDed FieldRules: repo_name and actors.
• docs/sources.md — documents the actor guardrail.

Semantics

Mirrors allow_repos/deny_repos: case-insensitive globs, deny wins, list-valued (kept if any involved login matches), and a non-empty allow_actors is fail-closed (a notification with no identifiable actor is dropped). Empty (the default) preserves existing behavior. The repo and actor rules AND together.

sync:
  github:
    allow_actors: ["alice", "bob"]   # only notifications involving these logins reach the inbox
    deny_actors:  ["noisy-bot"]

actors keys off the real enrichment author fields (comment/review authors), not body @-mention text, so it can't be spoofed by mentioning a trusted login.

Test plan

• pytest tests/test_source_filters.py tests/test_github_source_actors.py — 31 passed
• Full backend suite green except unrelated pre-existing failures (missing tests/fixtures/codex/... rollout fixtures)
• Coverage: actor FieldRule allow / deny / deny-wins / case-insensitive / fail-closed; _collect_actors de-dup & ordering; config parsing; fetch() metadata emission incl. the enrichment-failure path (actors == []); and build_source_runners wiring (active filter, passthrough when unset).