Always test approval authorization as fail-closed

When changing release approval logic, preserve comprehensive tests for authorization boundaries. Verify automated approver identities cannot directly approve or fall back to collaborator permissions, malformed publish titles return unauthorized with a null repository, and only target-repository roles write, maintain, or admin authorize humans. Cover qualified and unqualified repository titles, exact repository resolution, allowlist mismatches, and ensure rejected bot or malformed-title paths do not call GitHub permission APIs. Also verify permission lookup failures propagate rather than silently authorizing or degrading.