pr-gate: authorize runs on the dedicated authorize-only seat (fw16-tier2-3)

.github/workflows/pr-gate.yml

@@ -18,21 +18,21 @@
   authorize:
     # Runs on self-hosted intel. GitHub-hosted runners are BANNED fleet-wide:
     # they bill on private repos, and when the Actions spending limit is reached
     # the job does not start AT ALL — it reports `failure` with ZERO steps, which
     # is indistinguishable from this gate rejecting an author. That is exactly
     # what happened: this gate had NEVER executed on paiml/infra while showing
     # FAILURE on 100% of its PRs, so it was routinely stepped over (paiml/infra#231).
     # An authorization control that cannot start is worse than no control, because
     # it manufactures the appearance of enforcement.
     #
     # The original rationale for ubuntu-latest was that untrusted PR code must not
     # execute on self-hosted infra. That concern does not apply to THIS job: it has
     # exactly one step, `actions/github-script`, and there is NO `actions/checkout`
     # anywhere in this workflow. No PR-authored code is ever fetched or run here —
     # the job only reads `context.payload` and calls the API. If a checkout step is
     # ever added, this decision must be revisited.
     timeout-minutes: 22
-    runs-on: [self-hosted, gate-light]
+    runs-on: [self-hosted, authorize-only]
     permissions:
       pull-requests: write
     steps:
@@ -90,11 +90,11 @@
           # not ask" is the exact defect that closed two owners' PRs.
           membership() {
             local user="$1" resp rc state
             resp=$(gh api "orgs/${ORG}/memberships/${user}" 2>&1) && rc=0 || rc=$?
             if [ "$rc" -eq 0 ]; then
               state=$(printf '%s' "$resp" | jq -r '.state // "unknown"')
               # "pending" = invited, not accepted. Not a member yet.
               if [ "$state" = "active" ]; then echo member; else echo notmember; fi
               return 0
             fi
             case "$resp" in