feat(qa-review): gate + manual-dispatch workflow (step 1, pilot user-registration-pro)

[lihsaa591]

Summary

First staged piece of the PR QA-review agent: only the gate. No review is produced yet.

• qa-review.yml: repository_dispatch: qa-review or manual workflow_dispatch. Nothing triggers it automatically (no n8n yet).
• scripts/qa-review-gate.mjs: re-verifies against the live API (payload is untrusted): allowlist, PR open/not draft, same-repo, head_sha current, requester not the bot, requester has write+. Wrong token identity fails the job.
• scripts/qa-review-comment.mjs: one sticky PR comment (bot login + marker). Manual runs are silent unless post_comment=true.
• config/qa-review-repos.json: pilot allowlist = themegrill/user-registration-pro.

Testing

• npm test: 38/38 pass (10 new).
• Read-only check of real PR/permission API shapes against user-registration-pro#1765.
• NOT verified: that BOT_TOKEN_THEMEGRILL authenticates as tg-autopilot and can read the pilot repo. First step after merge: manual dispatch with post_comment=false.

Risk

Adds new files only. Existing workflows untouched; the new one runs only when started by hand.