Harden external-PR workflows and restrict command triggers

[e271828-]

Summary

• stop checking out untrusted approved PR commits in .github/workflows/e2e-external-phase-2.yml before running secret-bearing test steps
• keep testing target selection via COVERAGE_COMMENT_E2E_ACTION_REF, but execute the harness from trusted workflow code
• require /e2e and /invite triggers to come from repo maintainers (OWNER/MEMBER)

Security impact

This prevents exfiltration of long-lived e2e tokens from untrusted PR code execution and blocks arbitrary commenters from triggering secret-backed invite actions.

Validation

• YAML parse validation for updated workflow files (Psych.safe_load)

[github-actions]

End-to-end public repo

Admin commands cheatsheet:

• /e2e (in approved PR review body): Trigger end-to-end tests on external contributions
• /invite (in comment): Invite the author & admins to the end-to-end private repo

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.