ci: limit pull requests to maintainers and an allowlist of invited authors

.github/pr-authors.txt

@@ -0,0 +1,7 @@
+# Logins allowed to open pull requests, one per line, matched case-insensitively.
+# Repository owners, members and collaborators, and bots, are always allowed.
+lancy69
+chuiwenwei
+xxoingr
+kevin9327
+imcreazy

.github/pull_request_template.md

@@ -2,6 +2,9 @@
 Target branch: 2.x features and fixes go to `studio`. 1.x takes bug fixes,
 provider/API compatibility, release/updater, security and platform stability
 only, on `main-v2`.
+
+Pull requests are limited to maintainers and invited contributors; one from
+anyone else is closed automatically. Open an issue instead.
 -->
 
 ## Summary

.github/workflows/pr-author-gate.yml

@@ -0,0 +1,27 @@
+name: PR author gate
+
+# Pull requests are limited to maintainers and the logins in .github/pr-authors.txt.
+# This runs in the base repository's context, checks out the base branch only, and
+# never executes pull-request code; the allowlist it reads is the base branch's.
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: pr-author-gate-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - run: node scripts/pr-author-gate.mjs
+        env:
+          GH_TOKEN: ${{ github.token }}