[BYK]

Summary

• Accept getsantry[bot] approvals for exact auto-approve-repos.txt repository/path entries; reject other targets, including changed requests.
• Require the exact GitHub bot login, stable numeric actor ID, and Bot type for both Getsantry and Junior at the initial label event and subsequent live-event checks. GitHub issue label events expose actor IDs but no performing-App/installation ID.
• Retain Junior's existing target scope and human write/admin checks.

Validation

• Fail-first regressions covered the publish: getsentry/sentry-protos@0.81.1 #9788 Getsantry event, swapped/missing bot IDs, lookalike actors, changed targets, and malformed paths.
• pnpm test -- --printConsoleTrace: 18 files, 148 tests passed.
• pnpm lint, Prettier checks, generated-parser check, workflow YAML parsing, and git diff --check passed.

Fixes #9772
Refs #9788, #9786