ci: report workflows update only their own bot-authored issue

The link check, re-verify batch and thumbnail report found "their" issue by
label and title prefix only, so a user-opened issue with a matching title
could capture the report. Each lookup now also requires the issue's author
to be app/github-actions.

Closes #169

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LpkeXRUqm7oDedPDk3QWtK

Author: TMHSDigital

.github/workflows/links.yml

@@ -41,8 +41,9 @@ jobs:
           PROBLEMS: ${{ steps.check.outputs.problems }}
         run: |
           title="Link check: ${PROBLEMS} sources need a look"
-          existing=$(gh issue list --state open --label correction --json number,title \
-            --jq '[.[] | select(.title | startswith("Link check:"))][0].number // empty')
+          # Only the bot's own issue: anyone can open one with this label and title.
+          existing=$(gh issue list --state open --label correction --json number,title,author \
+            --jq '[.[] | select(.author.login == "app/github-actions" and (.title | startswith("Link check:")))][0].number // empty')
           if [ -n "$existing" ]; then
             gh issue edit "$existing" --title "$title" --body-file link-report.md
           else

.github/workflows/reverify.yml

@@ -40,8 +40,9 @@ jobs:
         run: |
           month=$(date -u +%Y-%m)
           title="Re-verify batch ${month}: ${COUNT} entries due a licence re-read"
-          existing=$(gh issue list --state open --label "help wanted" --json number,title \
-            --jq '[.[] | select(.title | startswith("Re-verify batch "))][0].number // empty')
+          # Only the bot's own issue: anyone can open one with this label and title.
+          existing=$(gh issue list --state open --label "help wanted" --json number,title,author \
+            --jq '[.[] | select(.author.login == "app/github-actions" and (.title | startswith("Re-verify batch ")))][0].number // empty')
           if [ -n "$existing" ]; then
             gh issue edit "$existing" --title "$title" --body-file reverify-batch.md
           else

.github/workflows/thumbs.yml

@@ -112,8 +112,9 @@ jobs:
           compare="https://github.com/${GITHUB_REPOSITORY}/compare/main...$(printf '%s' "$branch" | sed 's|/|%2F|g')?expand=1"
           { printf 'Open the pull request: %s\n\n' "$compare"; cat "$RUNNER_TEMP/thumbs-report.md"; } > "$RUNNER_TEMP/issue-body.md"
           title="Thumbnail refresh ${month}: ${CHANGED} changes"
-          existing=$(gh issue list --state open --label "enhancement" --json number,title \
-            --jq '[.[] | select(.title | startswith("Thumbnail refresh "))][0].number // empty')
+          # Only the bot's own issue: anyone can open one with this label and title.
+          existing=$(gh issue list --state open --label "enhancement" --json number,title,author \
+            --jq '[.[] | select(.author.login == "app/github-actions" and (.title | startswith("Thumbnail refresh ")))][0].number // empty')
           if [ -n "$existing" ]; then
             gh issue edit "$existing" --title "$title" --body-file "$RUNNER_TEMP/issue-body.md"
           else