Publish second-person approval

Always require an independent second person to approve a release; reject an issue requester approving their own request. Chose requester/approver separation over generic target-repository write access because a requester with label and repository permissions can otherwise self-approve. authorize-approval.js must fetch the live issue, fail closed if issue.user.login is missing, and reject a case-insensitive match with APPROVAL_ACTOR, with a regression test. Automatic approval is allowed only through an explicitly authenticated, request-bound automation path.