* feat(eval): measure PR cost before merge
Reuse authenticated historical MCP measurements for one pinned PR preview. Keep the protected main evaluator and publish separate evidence that cannot authorize a release.
* fix(eval): gate PR cost runs on a label
Require a repository writer label event and retain the opt-in label
and exact PR head before dispatch and paid sessions. Keep the
request handler on trusted base code and execute evaluation on main.
* ci: document trusted cost label trigger
* fix(eval): restrict previews to maintainer labels
Remove manual PR preview inputs and authorize Maintain/Admin roles before calling the protected reusable evaluator. Compare workflow measurement settings with historical evidence instead of exempting the entire workflow.
---------
Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
