feat: trust core team commits and verified bot commits in run-ci label validation

[keithwillcode]

What does this PR do?

Updates the run-ci label validation logic to trust commits made after the label was added if they come from trusted sources:

1. Core team members with write permission to the repo
2. Trusted bots (devin-ai-integration[bot], cubic-dev-ai[bot]) with verified commit signatures

Previously, when the run-ci label was "stale" (added before new commits were pushed), the PR would be marked as untrusted. Now, if all commits after the label are from trusted sources, the PR remains trusted.

Security model: Bot commits must be verified (signed by GitHub) to be trusted. This prevents external contributors from spoofing bot commits by setting their git author name to a bot name - they cannot forge a verified commit signature that GitHub creates when commits are made via the GitHub API.

How should this be tested?

This is a GitHub Actions workflow change that will be tested in production when the scenario occurs:

1. External contributor opens a PR
2. Maintainer reviews and adds run-ci label
3. Trusted bot (Devin or Cubic) or core team member pushes additional commits
4. The workflow should recognize these commits as trusted and allow CI to run

Manual verification: Review the logic flow and security assumptions in the code.

Mandatory Tasks (DO NOT REMOVE)

• I have self-reviewed the code (A decent size PR without self-review might be rejected).
• I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. N/A - no documentation changes needed.
• I confirm automated tests are in place that prove my fix is effective or that my feature works. N/A - GitHub Actions workflow changes cannot be unit tested.

Human Review Checklist

• Verify the security model: Can an external contributor bypass this by forging a verified commit? (They shouldn't be able to)
• Confirm the trusted bot list (devin-ai-integration[bot], cubic-dev-ai[bot]) is correct
• Review the compareCommits API response structure assumptions (author.type, commit.verification)
• Check edge case handling when runAtLabelTime is not found

---

Link to Devin run: https://app.devin.ai/sessions/dd01a0464a1445a18ded1bb9be7b59ed
Requested by: @keithwillcode

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring