Check Enforcer commands should validate caller has write permissions

## Enhancement

The \/check-enforcer\ slash commands (e.g., \/check-enforcer evaluate\, \/check-enforcer override\) currently execute without validating that the caller has write permissions to the repository.

## Suggestion

Before processing a \/check-enforcer\ command, the bot should verify that the user who issued the comment has **write** (or higher) permissions on the repository. If the caller lacks sufficient permissions, the command should be rejected with an appropriate message.

## Rationale

While there is no direct security implication identified today, adding a permissions check is a good **defense-in-depth** practice. It ensures that only users who are authorized to influence CI/check status can invoke these commands, reducing the surface area for potential misuse as the tool evolves.

## Expected Behavior

1. User comments \/check-enforcer \ on a PR or issue
2. Check Enforcer verifies the commenter has write permissions to the repository
3. If permissions are insufficient, respond with a message indicating the command was not authorized
4. If permissions are sufficient, proceed with the command as normal

## References and resources:

- [IcM](https://portal.microsofticm.com/imp/v5/incidents/details/31000000578368/summary) _(Microsoft internal)_

Start by locating the handlers for /check-enforcer commands and the code that processes evaluate and override. Identify how repository permissions can be checked for the commenter, then verify both authorized and unauthorized command paths. Done means insufficient permissions receive an authorization message while users with write or higher permissions proceed normally.

Written by the indexing model from the issue text.