bridge: polling primary + org-membership auth (orchestrator design change)

Polling is now the primary, read-only trigger (always-on thread); the /hook
webhook is an optional admin-registered push optimization deduped by comment id.
Authorize commenters via GET /orgs/{owner}/members/{user} (204, read-level) +
optional allowlist, replacing the admin-requiring /collaborators permission
endpoint. Bot never self-registers webhooks. Enroll = POLL_REPOS + tests/<recipe>/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

modules/bridge.nix

@@ -31,6 +31,11 @@ let
           - DRONE_URL=https://drone.ci.commoninternet.net
           - CI_REPO=recipe-maintainers/cc-ci
           - BRIDGE_LISTEN=0.0.0.0:8080
+          # Polling is PRIMARY (outbound, read-only, always on); the /hook webhook is an optional
+          # admin-registered push optimization deduped against the poller (§4.1). Enrollment = add
+          # the repo to POLL_REPOS (csv) + ensure tests/<recipe>/ exists.
+          - POLL_INTERVAL=30
+          - POLL_REPOS=recipe-maintainers/cc-ci
           - HMAC_FILE=/run/secrets/webhook_hmac
           - DRONE_TOKEN_FILE=/run/secrets/drone_token
           - GITEA_TOKEN_FILE=/run/secrets/gitea_token