bridge: polling primary + org-membership auth (orchestrator design change)

Polling is now the primary, read-only trigger (always-on thread); the /hook
webhook is an optional admin-registered push optimization deduped by comment id.
Authorize commenters via GET /orgs/{owner}/members/{user} (204, read-level) +
optional allowlist, replacing the admin-requiring /collaborators permission
endpoint. Bot never self-registers webhooks. Enroll = POLL_REPOS + tests/<recipe>/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -48,6 +48,27 @@ Architecture decisions and dead-ends. One line of rationale each. (§0, §8)
     wildcard means bumping `SECRET_WILDCARD_*_VERSION` (operator) so the next reconcile re-inserts.
     Documented in docs/secrets.md at M7.
 
+- **Trigger: POLLING primary, webhook optional — SETTLED (orchestrator design change 2026-05-27,
+  supersedes the earlier "keep webhook, do NOT pivot to polling" steer).** Hard constraint: the
+  bot/server runs at **READ level, never repo-admin**, and **never self-registers a webhook**.
+  - **Polling is PRIMARY and the source of truth for D1.** The bridge polls each enrolled repo's
+    open PRs for new `!testme` comments every `POLL_INTERVAL` (30s ≤ 60s). Outbound
+    (cc-ci → git.autonomic.zone, the reliably-working direction), needs only read+comment. On
+    startup the first poll marks pre-existing comments seen so it doesn't fire on old comments.
+  - **Webhook is an OPTIONAL push optimization.** The `/hook` endpoint stays live (HMAC-verified)
+    so an *admin-registered* `issue_comment` webhook lowers latency, but the bridge never registers
+    one. Manual registration is documented in `docs/enroll-recipe.md`. Both paths share an
+    in-memory seen-set keyed by comment id → a comment seen by both fires at most once.
+  - **Commenter authorization via org membership (read-level, no admin).** Allowed iff
+    `GET /orgs/{owner}/members/{user}` → 204 (verified 2026-05-27: admits bot/trav/notplants, 404
+    for a non-member, works with bot read-level basic-auth) **or** the user is in the optional
+    `AUTH_ALLOWLIST`. Replaces the earlier `/collaborators/{user}/permission` check, which needs
+    repo-admin. Fail-closed on any error.
+  - **Enrollment** = add the repo to the bridge `POLL_REPOS` csv + ensure `tests/<recipe>/` exists.
+    No webhook required for CI to work. (Why root cause of the old webhook non-delivery doesn't
+    matter: polling makes it irrelevant; the operator was whitelisting `ci.commoninternet.net` in
+    Gitea's `ALLOWED_HOST_LIST`, but D1 no longer depends on that.)
+
 ## Open (defaults from §8, to confirm as reality lands)
 
 - **Deploy mechanism — SETTLED (M0):** `nixos-rebuild switch --flake /root/cc-ci#cc-ci` run *on