coderabbit-gate: coderabbit-approved status 403s on fork prs, blocking external contributions

[Yurii214]

the coderabbit-gate workflow (added in #508) can't publish the required coderabbit-approved commit status for a pr opened from a fork, so native auto-merge never completes for external contributions and the pr shows a failing gate check even after an approved review.

repro: #499 and #502 (both from the Yurii214/vouch fork → test). after a push, the gate job's "publish coderabbit-approved status" step fails:

VERDICT: approved
STATE: success
gh api --method POST repos/vouchdev/vouch/statuses/<head_sha> ...
gh: Resource not accessible by integration (HTTP 403)

note the verdict was approved — the gate wanted to green-light the pr; only the status write failed.

cause: the gate job declares statuses: write and runs on pull_request_target, but the base-repo GITHUB_TOKEN still can't create a commit status on a fork's head sha (POST /repos/{repo}/statuses/{sha} → 403 "resource not accessible by integration"). same-repo prs (#500 / #507 / #508) never hit this because their head sha lives in the base repo, so it slipped through review.

impact: every fork/external contributor is affected — the required coderabbit-approved status can never be set, so the pr stays un-mergeable via the bot and shows a red gate check even after an approved verdict.

fixes:

• short term (mitigation pr incoming): don't fail the infra job on a fork-head 403 — warn instead, so external prs stop showing a spurious red check. the unset status still blocks auto-merge, so a maintainer merges by hand.
• robust: publish the status with a token that can write to fork heads — a fine-grained PAT / github app installation token stored as a secret, used only for the POST /statuses call — or publish via the checks api instead of the statuses api.