#21587 fix(merge): trust owner-controlled cmux fork heads

Summary

Allow gh-merge-green to trust the owner-controlled teamleaderleo/cmux fork for local merged-head checks. Unknown forks remain fail-closed unless the caller supplies the exact reviewed SHA with --trust-fork-head.

The allowlist is repository-specific and case-insensitive. Exact-head, hosted-check, freeze, and merged-tree gates still run for the trusted fork.

Validation

• bash -n scripts/gh-merge-green
• gh pr view 21557 --repo manaflow-ai/cmux --json headRepositoryOwner,headRepository,isCrossRepository confirmed teamleaderleo/cmux
• #21557 merged at exact head 866a5af7c0f662207cb3ac9b18cc83cba087525e

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Allows gh-merge-green to trust the owner-controlled fork teamleaderleo/cmux for local merged-head checks. Other forks remain fail-closed unless the exact reviewed SHA is supplied with --trust-fork-head; the allowlist is repository-specific and case-insensitive, and exact-head, hosted-check, freeze, and merged-tree gates still run for the trusted fork.

Summary by CodeRabbit

• Bug Fixes
  • Improved merged-head checks for pull requests from the trusted teamleaderleo/cmux repository, including case-insensitive repository matching.
  • Clarified when a fork is untrusted and must be explicitly trusted before its head can be checked.