feat: Improve documentation suggestion workflow

[Corey-T1000]

Summary

Improves the documentation suggestion workflow based on security review and usability feedback.

Security Improvements

• Org membership validation: Label-based triggers now verify the label adder is an org member via GitHub API
• Tightened tool allowlist: Replaced Bash(git:*) wildcards with explicit commands (checkout, branch, add, commit, push, diff)
• Fixed DRY_RUN type bug: Boolean-to-string coercion was causing label check bypass
• Concurrency control: Only one workflow run per issue at a time
• Reduced fetch-depth: Changed from 0 to 1 to limit git history exposure
• Restricted WebFetch: Limited to docs.authzed.com only

UX Improvements

• Structured issue template: New doc-suggestion.yml template with required fields
• Auto-create draft PR: Workflow now creates the PR directly (not just a link)
• Vercel preview URL: Issue comment includes preview link for reviewers
• Smart reviewer assignment: Labels added by org members → reviewer is label adder; otherwise issue author
• Timeout notifications: Cancelled/timed-out jobs now notify the issue author
• Resilient failure handling: Notification steps use continue-on-error to avoid silent failures

Trigger Logic

Trigger	Who	What Happens
Issue opened with Docs label	Org member	Auto-runs
approved label added	Org member (verified)	Runs
workflow_dispatch (dry_run=true)	Anyone with dispatch access	Dry run only
workflow_dispatch (dry_run=false)	Anyone with dispatch access	Requires approved label

Test Plan

• Create test issue using new template as org member → should auto-trigger
• Run workflow_dispatch with dry_run=true on existing issue → should analyze without changes
• Have non-org user create issue → should NOT auto-trigger
• Add approved label as org member to external issue → should trigger
• Verify Vercel preview URL format in generated comments
• Test timeout scenario (optional - requires long-running task)

Files Changed

• .github/ISSUE_TEMPLATE/doc-suggestion.yml (new)
• .github/workflows/claude.yml (modified)

---

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
docs	Ready	Preview, Comment	Jan 16, 2026 9:32pm

[github-actions]

CLA Assistant Lite bot:
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request}

[samkim]

Closing in favor of #489

Most of the changes in this PR are changing intentional decisions and limits placed in the workflow currently.