fix(github): allow CONTRIBUTOR association by default

[abyigiter]

Summary

• GitHub labels some write-access teammates as CONTRIBUTOR or FIRST_TIME_CONTRIBUTOR, not MEMBER.
• The payload association gate skipped those PRs before the live write check ran.
• Default allowlist now includes both labels. Write/admin is still required.

Why

Observed on OMSX: a teammate with repo write got author association not allowed: CONTRIBUTOR on pull_request, so automatic review never started.

GitHub does this for private org membership, and some org-repo permission shapes. The live collaborator-permission check is the real security boundary. NONE still skips. Repos can still narrow allowed-associations.

Test plan

• pnpm exec vitest run tests/github-action.test.ts (45 passed)
• pnpm run typecheck
• Confirm a CONTRIBUTOR author with write gets a review after this ships to npm and consumers bump the action pin

Risks / follow-ups

• This does not fix existing consumers until a codegenie release. The action installs the published npm version, not the git SHA's TypeScript.
• Immediate workaround on current v0.5.5: pass allowed-associations: OWNER,MEMBER,COLLABORATOR,CONTRIBUTOR,FIRST_TIME_CONTRIBUTOR.
• After release, OMSX still has to bump 0xPolygon/codegenie@<sha>.