Sync controller authorization on deploy

[gabotechs]

Summary

• pass the committed authorized GitHub login list through normal controller releases
• update only AUTHORIZED_GITHUB_LOGINS in the protected controller environment, preserving GH_TOKEN
• ignore upstream AMI drift so application deploys do not replace the persistent controller

Validation

• npm run build
• npm test (106 tests)
• deployed in place to the existing controller
• verified live allowlist contains all three committed users
• replayed PR 639 request accepted as benchmark job 44
• final Pulumi preview: 16 resources unchanged