Auto-close PRs from authors not listed in .github/VOUCHED.td. Issues
stay open to everyone; the close message points contributors at
CONTRIBUTING.md. Maintainers manage the list with !vouch, !denounce
and !unvouch comments, and a weekly job resyncs CODEOWNERS.
The workflows use GITHUB_TOKEN with explicit least-privilege
permissions.
Self-hosted-runner shape (repositories, platform, gitAuthor) that a
repo-level config cannot set, and nothing has run it since the workflow
was removed in 6a311f4ab.