fix: Align /hold permission with /verified and /wip status-label gate #1164

Summary

Align /hold so PR authors can set/clear hold without being OWNERS approvers, while keeping the gate narrower than /verified//wip because hold is merge-blocking: author OR OWNERS pull-request approvers only.

Intentional permission model

/hold is merge-blocking, so its gate is narrower than /verified and /wip:

1. PR author (parent_committer), OR
2. OWNERS pull-request approvers

Rationale: external authors must be able to hold their own PR (the original pain vs approvers-only), but collaborators/contributors/reviewers who are not approvers must NOT be able to block merges via /hold.

/verified and /wip keep _can_manage_pr_status_label (author OR is_user_valid_to_run_commands).
/hold uses dedicated _can_manage_hold_label (author OR approvers).

Problem / Motivation

/hold is currently approvers-only in webhook_server/libs/handlers/issue_comment_handler.py (checks all_pull_request_approvers and posts "only approvers can mark pull request with hold").

/verified and /wip already use _can_manage_pr_status_label which allows:

1. PR author (parent_committer)
2. OR users who pass is_user_valid_to_run_commands

External PR authors cannot /hold their own PR without being an OWNERS approver. We need author access for /hold (as in #1155 / #1156 for verified/wip), but with a dedicated narrower gate because hold blocks merges.

Root cause

Hold branch (around lines 464-479 in issue_comment_handler.py) uses a separate approver-only check instead of _can_manage_hold_label (author OR approvers).

Requirements

1. Replace the approver check + custom comment with _can_manage_hold_label (author or approvers)
2. Update the helper docstring for _can_manage_hold_label / related hold helpers
3. Update tests: author can hold; unrelated blocked; non-approver collaborators/contributors denied; approver still works

Deliverables

• Code changes in issue_comment_handler.py
• Unit tests covering author allow, deny, and approver paths
• Documentation / docstring updates as needed

Out of scope

• Merge-blocker semantics of the hold label
• Draft-PR allowlist
• Other commands

Done

• /hold and /hold cancel use _can_manage_hold_label (author or approvers; not the shared _can_manage_pr_status_label gate)
• PR author can set/clear hold without being an OWNERS approver (covered by unit tests; manual verify still open)
• Unrelated commenters still denied (unit tests)
• OWNERS pull-request approvers still can set/clear hold (unit tests)
• Unit tests cover author allow, deny, and approver paths
• Full verify passes (ruff, mypy, pytest) — ruff/format pass; pytest all green; coverage 89.68% is pre-existing on main