Auto-trigger full Kind + OpenShift E2E on PR approval (trusted reviewers only)

[mamy-CS]

Automate E2E triggering when a PR receives an approval from a user with write access, so maintainers no longer need to manually comment /ok-to-test

Safety / guardrails

• Only accept approvals from users with admin/maintain/write.
• Handle fork PRs safely (no direct secret/runners exposure from untrusted context).
• De-duplicate by PR head SHA (avoid re-approval/review churn triggering duplicate GPU runs).
• Optional: allow label-based opt-in/out to control GPU cost.

Acceptance criteria

• Approved PR automatically starts full Kind E2E and OpenShift E2E.
• Fork PRs still follow secure execution constraints.
• Re-approving without new commits does not trigger duplicate runs.
• Existing manual commands still work (/ok-to-test for compatibility, /retest for reruns)