Add fail-closed author allowlist gating job dispatch

Sessions run claude with --dangerously-skip-permissions and a prompt built
from issue/PR/comment text, so only trusted authors may supply that text.
teabot now dispatches a job only when the triggering event's author login is
on an allowlist; an empty allowlist dispatches nothing (fail-closed).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/cli/run.go

@@ -35,6 +35,10 @@ func newRunCmd() *cobra.Command {
 				return err
 			}
 
+			if !cfg.HasAnyAllowlist() {
+				logger.Warn("no allowed_authors configured; teabot is fail-closed and will dispatch NOTHING until an allowlist is set")
+			}
+
 			store, err := state.New(cfg.StateDirOrDefault())
 			if err != nil {
 				return err