Error `no workflow defined for` when workflow is triggered by `Approve and run`

When a workflow is triggered by maintainer clicking Approve and run for first time contributoros, pkg.pr.new fails with There is no workflow defined for ... error.

• https://github.com/vitest-dev/istanbuljs/actions/runs/33378231084/job/99459555423?pr=11

🤖 analysis of the root cause indicating mis-match between GITHUB_ACTOR_ID and sender.id:

/check 404s on re-runs and approval-gated fork PRs: CLI keys on GITHUB_ACTOR_ID but webhook keys on sender.id

pkg-pr-new publish fails with Check failed (404): There is no workflow defined for <key> whenever the person who caused the current workflow attempt to run is not the original triggering actor — i.e. a maintainer re-running a fork PR's jobs, or approving a first-time contributor's run.

Cause

The CLI and the webhook handler compute the storage key from different actor IDs:

• CLI (packages/cli/index.ts) hashes { owner, repo, run, attempt, actor: GITHUB_ACTOR_ID }. Per GitHub's docs, GITHUB_ACTOR is the user who triggered the initial run — on a re-run it stays the original actor and does not become the re-runner (GITHUB_TRIGGERING_ACTOR does).
• The server (packages/app/server/routes/webhook.post.ts) stores the workflow entry under { owner, repo, run, attempt, actor: payload.sender.id }. On a workflow_run webhook for a re-run/approved run, sender is the maintainer who clicked re-run/approve.

So for attempt N of a re-run: webhook stores under hash(..., actor: maintainer_id), CLI looks up hash(..., actor: pr_author_id) → key not found → 404.

Start by comparing actor-ID handling in packages/cli/index.ts with packages/app/server/routes/webhook.post.ts, focusing on how the workflow storage key is built. Reproduce or trace an approved or re-run fork pull request and verify that the CLI and webhook use the same key so pkg.pr.new no longer returns the 404 workflow error.