Claude backend reviewer: replace the hardcoded author allowlist with a team membership check

Description

.github/workflows/ai_claude-backend-reviewer.yml gates the reviewer on a hardcoded list of GitHub logins:

PILOT_AUTHORS='["gortiz-dotcms","danielsolis-dotcms","danielsilva-dotcms"]'

A hardcoded list drifts. Entries stay behind when someone's account changes, and new accounts are missed until somebody notices a review that never arrived — which is how #37293 came about. Nothing connects a change in org membership to this file.

The workflow's own comment already anticipates this:

To expand: add logins to PILOT_AUTHORS or replace with a team membership check.

Replacing the list with a check against the maintenance-engineers team would keep the gate in step with org membership automatically, and remove the maintenance step entirely.

Blocked on a token

This is not a drop-in edit. Reading org team membership requires a token with the read:org scope, and secrets.GITHUB_TOKEN is repository-scoped — it cannot query team membership. No suitable org-scoped token or GitHub App credential is referenced by any workflow in this repository today.

Implementing the check without that token in place would make Gate 1 fail — and given how the gate is written, it would fail closed and silently, skipping review for everyone. That is worse than the current hardcoded list.

So this needs, in order:

1. An org-scoped credential provisioned as a repository or organization secret (a GitHub App installation token is preferable to a personal access token, since it is not tied to an individual).
2. The gate rewritten to query team membership using it.
3. A deliberate decision about failure behaviour — see below.

Acceptance Criteria

• An org-scoped credential with read:org is available to the workflow.
• Gate 1 resolves authorization from team membership rather than a hardcoded list of logins.
• The behaviour when the membership lookup fails (token expired, API error, rate limit) is chosen deliberately and documented in the workflow — failing closed silently is the current failure mode of the hardcoded gate and is the thing worth avoiding.
• A skipped review leaves some trace on the PR, or is otherwise discoverable without reading workflow logs (see below).
• PILOT_AUTHORS is removed once the team check is in place, so there is a single source of truth.

Additional Context

Related: a skip is currently invisible. Gate 1 logs ℹ️ … is not in the pilot list and exits successfully. Nothing appears on the PR, so "author not authorized" and "the bot is broken" look identical from the outside. This cost real time to diagnose on #37288 — the review simply never appeared and there was no signal as to why. Worth addressing alongside this, whichever way the gate is implemented.

Interim fix already merged/open: #37293 corrects the current list.

Start with .github/workflows/ai_claude-backend-reviewer.yml and the Gate 1 comment, then review #37293 for the current allowlist context. Confirm how the required org-scoped credential can be provisioned before tracing the team-membership check and its failure behavior against the acceptance criteria. Done means the team is the single authorization source and skipped reviews are discoverable.