Gate copilot-review on same-repo PRs, not author_association

The pull_request_target event payload reports author_association as
CONTRIBUTOR for org members on same-repo branches (confirmed via the
debug-event job added in #1592 and fired by #1593), so the previous
gate filtered out every maintainer PR.

Switch to head.repo.full_name == base.repo.full_name. Same-repo PRs
require push access to the base repo, which is the maintainer signal
we actually want. Fork PRs (where the maintainer cannot push to base)
remain excluded.

Also removes the now-unneeded debug-event job.

Author: brendancol

.github/workflows/copilot-review.yml

@@ -8,22 +8,13 @@ permissions:
   pull-requests: write
 
 jobs:
-  debug-event:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Print gate inputs
-        run: |
-          echo "action=${{ github.event.action }}"
-          echo "draft=${{ github.event.pull_request.draft }}"
-          echo "assoc=${{ github.event.pull_request.author_association }}"
-          echo "user=${{ github.event.pull_request.user.login }}"
-          echo "head_repo=${{ github.event.pull_request.head.repo.full_name }}"
-          echo "base_repo=${{ github.event.pull_request.base.repo.full_name }}"
-
   request-copilot-review:
+    # Same-repo PRs only. author_association in the pull_request_target payload
+    # reports CONTRIBUTOR for org members on same-repo branches, so head==base
+    # is the reliable maintainer signal (it requires push access to the base repo).
     if: >-
       github.event.pull_request.draft == false &&
-      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association)
+      github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name
     runs-on: ubuntu-latest
     steps:
       - name: Request Copilot review