feat(automerge): allow multiple bot identities via array allow-list

[npiccolo]

What

Replaces the hardcoded svc-cli-bot author check in cli:release:automerge
with a small allow-list array (ALLOWED_BOT_USERS) and an exported helper
isAllowedBotUser(). Adds svc-idee-bot to the list.

// Before
if (prData.user?.login !== 'svc-cli-bot') {
  stop('PR must be created by "svc-cli-bot"');
}

// After
if (!isAllowedBotUser(prData.user?.login)) {
  stop(`PR must be created by one of: [${ALLOWED_BOT_USERS.join(', ')}]`);
}

Why

Today the command rejects any PR not authored by svc-cli-bot. This
extends the check to support additional bots so other teams can reuse
cli:release:automerge for their own automerge flows. New bots get
added by reviewed PR to the allow-list constant.

Tests

Adds test/commands/cli.release.automerge.test.ts covering:

• svc-cli-bot still passes (regression)
• svc-idee-bot passes
• arbitrary other login is rejected
• undefined / null / empty-string login is rejected
• the canonical allow-list shape

Run with npx mocha test/commands/cli.release.automerge.test.ts — all 7 pass locally.