[ci-scan-feedback] unblock ci-failure-fix from integrity gate on bot-authored KBEs

## Triggering signals

- **ci-failure-fix run 32850977299** (latest) — every open `[ci-scan]` KBE returned `[Filtered]`; tally: `| (all) | n/a | skipped | integrity-filtered candidate, needs human review |`. Fixer no-op'd. ([run](https://github.com/dotnet/runtime/actions/runs/32850977299))
- **ci-failure-fix run 32796116611** (prior) — same: 1 candidate (#130182) `[Filtered]` → noop. ([run](https://github.com/dotnet/runtime/actions/runs/32796116611))
- **Rubric finding (structural):** the only open `[ci-scan]` KBE (#130182) is authored by `github-actions[bot]`, association `CONTRIBUTOR`, which fails the fixer's `min-integrity: approved` gate. Because *all* `[ci-scan]` KBEs are filed by the sibling scanner via the same bot, the fixer can **never** read its own input and is 100% inert every run.

## Proposed edits

- `.github/workflows/ci-failure-fix.md:43-53` — add `trusted-users: ["github-actions[bot]"]` to the `github` tool config so first-party KBE **bodies** authored by the scanner bot pass the integrity gate. Rationale: unblocks the fixer-inert outage above.
- `.github/workflows/ci-failure-fix.md:154` (Step 2) — clarify that a KBE **body** is first-party workflow output (trusted, passes the gate) while maintainer **comments** stay association-gated and any `[Filtered]` comment is still skipped. Rationale: preserves the integrity gate's purpose (filtering maintainer-supplied content) while unblocking the read.

## Expected behavior change

Next run, the fixer's `search_issues` enumeration of open `[ci-scan]` KBEs will no longer be uniformly `[Filtered]`. The fixer will read each bot-authored KBE body, evaluate a fix, and produce real artifacts (confident/help-wanted PRs or a loop-in comment) instead of no-op'ing on `integrity-filtered candidate, needs human review` every tick. Maintainer comments on those KBEs remain association-gated, so untrusted content is still filtered — only the trusted first-party body is now readable.

> [!NOTE]
> This PR was generated by an AI agent (GitHub Copilot).

> Generated by [CI Outer-Loop Failure Scanner — Feedback](https://github.com/dotnet/runtime/actions/runs/32851856108) · opus48 · 567.7 AIC · ⌖ 26.1 AIC · ⊞ 20.6K · [◷](https://github.com/search?q=repo%3Adotnet%2Fruntime+%22gh-aw-workflow-id%3A+ci-failure-scan-feedback%22&type=pullrequests)

---

> [!NOTE]
> This was originally intended as a pull request, but the git push operation failed.
>
> **Original error:** The process '/usr/bin/git' failed with exit code 1
>
> **Workflow Run:** [View run details and download bundle artifact](https://github.com/dotnet/runtime/actions/runs/32851856108)
>
> The bundle file is available in the `agent` artifact in the workflow run linked above.

To create a pull request with the changes:

```sh
# Download the artifact from the workflow run
gh run download 32851856108 -n agent -D /tmp/agent-32851856108

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-32851856108/aw-ci-scan-feedback-fixer-integrity.bundle refs/heads/ci-scan-feedback-fixer-integrity:refs/bundles/create-pr-ci-scan-feedback-fixer-integrity-2f8027524e091c30-d2506f17
git update-ref refs/heads/ci-scan-feedback-fixer-integrity-2f8027524e091c30 refs/bundles/create-pr-ci-scan-feedback-fixer-integrity-2f8027524e091c30-d2506f17
git checkout ci-scan-feedback-fixer-integrity-2f8027524e091c30
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-ci-scan-feedback-fixer-integrity-2f8027524e091c30-d2506f17

# Push the branch to origin
git push origin ci-scan-feedback-fixer-integrity-2f8027524e091c30

# Create the pull request
gh pr create --title '[ci-scan-feedback] unblock ci-failure-fix from integrity gate on bot-authored KBEs' --base main --head ci-scan-feedback-fixer-integrity-2f8027524e091c30 --repo dotnet/runtime
```

Read .github/workflows/ci-failure-fix.md, especially lines 43-53 and Step 2 at line 154, then compare the integrity behavior with the linked ci-failure-fix runs. The change is done when bot-authored [ci-scan] KBE bodies are readable, maintainer comments remain association-gated, and a subsequent run no longer filters every candidate.

Written by the indexing model from the issue text.