workflow: enforce the collaborator gate (author_association)

the github-as-substrate workflow's if: only checks for the ```spin marker:

if: >
  contains(github.event.issue.body, '```spin') ||
  contains(github.event.comment.body, '```spin')

the header comment claims a collaborator gate, but there is none — any
stranger can open an issue with a ```spin block and spend the repo's Actions
minutes (a free-compute faucet). discovered while proving #5 live.

fix

add an author_association check to the if:, e.g.

if: >
  (contains(github.event.issue.body, '```spin') ||
   contains(github.event.comment.body, '```spin')) &&
  contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'),
           github.event.issue.author_association ||
           github.event.comment.author_association)

verify with a non-collaborator account (or a fork PR) that it actually
blocks. note author_association is per-event (issue vs comment) — handle both.

Start with the github-as-substrate workflow and its existing if: expression. Add the collaborator gate while handling issue and comment author_association values, then verify with a non-collaborator account or fork PR that a spin block is blocked and an allowed association still runs.