ci: add minimal permission gate for e2e tests

Add a simple gate job that checks if the PR author is privileged
(admin/maintain/write). E2E tests only run for privileged users.

External contributors will need the full /ok-to-test flow which
will be enabled once the gate workflow is merged to main.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: clubanderson

.github/workflows/ci-e2e-openshift.yaml

@@ -42,8 +42,39 @@ on:
         default: '30'
 
 jobs:
+  # Gate: Check if PR author is privileged (admin/maintain/write)
+  # External contributors need maintainer approval via /ok-to-test (handled by gate workflow after merge)
+  gate:
+    runs-on: ubuntu-latest
+    outputs:
+      should_run: ${{ steps.check.outputs.should_run }}
+    steps:
+      - name: Check permissions
+        id: check
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Always run for workflow_dispatch
+            if (context.eventName === 'workflow_dispatch') {
+              core.setOutput('should_run', 'true');
+              return;
+            }
+
+            // Check PR author permission
+            const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              username: context.payload.pull_request.user.login
+            });
+            const privilegedRoles = ['admin', 'maintain', 'write'];
+            const isPrivileged = privilegedRoles.includes(permission.permission);
+            console.log(`PR author ${context.payload.pull_request.user.login}: ${permission.permission}, privileged: ${isPrivileged}`);
+            core.setOutput('should_run', isPrivileged ? 'true' : 'false');
+
   # Build the WVA controller image on GitHub-hosted runner (has proper Docker setup)
   build-image:
+    needs: gate
+    if: needs.gate.outputs.should_run == 'true'
     runs-on: ubuntu-latest
     outputs:
       image_tag: ${{ steps.build.outputs.image_tag }}
@@ -86,7 +117,8 @@ jobs:
   # Run e2e tests on OpenShift self-hosted runner
   e2e-openshift:
     runs-on: [self-hosted, openshift]
-    needs: build-image
+    needs: [gate, build-image]
+    if: needs.gate.outputs.should_run == 'true'
     env:
       MODEL_ID: ${{ github.event.inputs.model_id || 'unsloth/Meta-Llama-3.1-8B' }}
       ACCELERATOR_TYPE: ${{ github.event.inputs.accelerator_type || 'H100' }}