feat(orchestrator): inbound external-PR discovery + review-task ingestion

Add the dormant inbound path for external-PR review (gated by external_pr_enabled,
off by default):

- GitService.list_open_prs lists a project's open PRs, normalized with fork /
  author-association classification (the inbound counterpart to the org's
  outbound, head-filtered PR calls).
- TaskService.ingest_external_pr + external_review_task_exists create one
  de-duped review task per newly-seen external PR (source='external_pr',
  confirmed_by_human=False) — a gate so no agent fetches or runs contributor
  code until a human confirms the PR.
- A poll loop in the orchestrator, mirroring the strategy-engine loop: only when
  enabled it lists each active project's open PRs, ingests the external ones, and
  wakes the dispatcher.

The trust-critical author/fork classifier is unit-tested; the GitHub-list and
DB-ingest paths are exercised by the integration gate.

tests/unit/runtime/test_external_pr_classify.py

@@ -0,0 +1,34 @@
+"""External-PR author/fork classification — the inbound trust decision.
+
+``_is_external_pr`` decides whether an open PR was authored by the org itself
+or by an outside contributor. It must default to *external* (the cautious
+side) for anything it does not positively recognize as internal.
+"""
+
+from __future__ import annotations
+
+import pytest
+from roboco.runtime.orchestrator import AgentOrchestrator
+
+
+@pytest.mark.parametrize(
+    ("pr", "expected"),
+    [
+        # A fork head is always external, regardless of association.
+        ({"is_fork": True, "author_association": "OWNER"}, True),
+        # Same-repo branch from a trusted association is internal (the org).
+        ({"is_fork": False, "author_association": "OWNER"}, False),
+        ({"is_fork": False, "author_association": "MEMBER"}, False),
+        ({"is_fork": False, "author_association": "COLLABORATOR"}, False),
+        ({"is_fork": False, "author_association": "member"}, False),  # case-insensitive
+        # Outside associations are external even on a same-repo branch.
+        ({"is_fork": False, "author_association": "CONTRIBUTOR"}, True),
+        ({"is_fork": False, "author_association": "FIRST_TIME_CONTRIBUTOR"}, True),
+        ({"is_fork": False, "author_association": "NONE"}, True),
+        ({"is_fork": False, "author_association": None}, True),
+        # Unknown/empty shape defaults to external (cautious).
+        ({}, True),
+    ],
+)
+def test_is_external_pr(pr: dict[str, object], *, expected: bool) -> None:
+    assert AgentOrchestrator._is_external_pr(pr) is expected