feat: allow GitHub team trigger filters

[michaelmwu]

Summary

• add GitHub filters.from_teams allowlists using organization/team-slug
• check membership with the webhook installation token and accept only active members
• fail closed for pending, absent, unavailable, or permission-denied membership checks
• update the single-repository team-bot example and coverage

Why

Workflow authors should be able to authorize a GitHub team without maintaining a list of every member login.

User impact

from_teams is GitHub-only and combines with from_users as an OR allowlist. It requires the GitHub App's organization Members permission with read access; if membership cannot be established, Hub does not start a run.

Validation

• npm run typecheck
• npm run lint
• npm run format:check
• focused GitHub trigger, compiler, provider, membership, and reaction tests
• npm test was attempted; unrelated Testcontainers-based daemon and integration tests could not run because this environment has no working container runtime