ship/landing-report: distinguish maintainer-gated CI and merge-queue handoff from failures

## Problem

External-contributor PRs can be technically ready while every Actions run reports `action_required` and Trunk refuses queue submission because the author has no repo write/Trunk membership. Today that state is easy for an agent/user to misread as failed CI or something worth retrying.

Concrete example: #2658. Its head `0f4f2fd58d7c338473963d95cdfed9d82943b536` has eight PR workflow runs whose conclusion is `action_required`, and `/trunk merge` was retried three times; each attempt was rejected with: `Only users that are a part of this repo's Trunk organization or have write permissions to the repo can submit a PR to the queue`.

That is not a code failure. It is a maintainer handoff state.

## Desired behavior

Teach the shipping/reporting path to classify this explicitly, e.g.:

`READY — MAINTAINER ACTION REQUIRED`

with the concrete remaining action (approve/run fork workflows, resolve current-base drift if any, then submit/merge with maintainer authority).

## Suggested detection

- Treat GitHub Actions conclusion `action_required` separately from `failure`/`cancelled`.
- When a PR is cross-repository/from a fork, recognize that maintainer approval may be required before Actions run.
- If Trunk returns the known write-permission/organization rejection, stop retrying queue submission and surface the handoff instead.
- Preserve real failures: if approved CI later runs and fails, report the actual failing check normally.

## Acceptance

- A fixture representing #2658-style fork PR + all `action_required` checks produces a maintainer-handoff result, not `CI failed`.
- A Trunk permission rejection is terminal for the current actor/session (no repeated `/trunk merge`).
- A normal same-repo PR with red checks still reports failure.
- Mixed states remain explicit (e.g. `2 failed, 5 action_required`).
- No automatic privilege escalation or bypass of maintainer controls.

This is workflow ergonomics only; it should not weaken any merge, CI, or security gate.

Start in the ship/landing-report path and trace how GitHub Actions conclusions and Trunk queue-submission responses are classified. Add a #2658-style fork fixture with action_required checks, a terminal Trunk permission rejection, and mixed states; verify these produce maintainer handoff output while normal same-repository failures remain failures.

Written by the indexing model from the issue text.