fix: validate community roster GitHub handles before the API fetch

[kubestellar-hive]

Security Fix

scripts/fetch-community-people.mjs interpolated the github field from
data/community-roster.json directly into an api.github.com request path,
with no validation and no percent-encoding:

const response = await fetch(`https://api.github.com/users/${github}`, { headers });

The literal prefix pins the origin, so this was never a cross-origin token
leak — api.github.com cannot be replaced. What it allowed was endpoint
confusion: a handle such as ../../orgs/evil resolves to
https://api.github.com/orgs/evil, and that response body is what gets written
into data/community-people.json (name, company, bio, location,
blog, avatar_url) and rendered by src/components/CommunityPeople.
.github/workflows/refresh-community-people.yml runs this on a schedule and
opens the refresh PR automatically, so a malformed handle propagates without
the roster diff being re-read.

What this changes

scripts/fetch-community-people.mjs only:

• Adds GITHUB_HANDLE, matching GitHub's username grammar (alphanumerics plus
  single internal hyphens, 1-39 characters), and exits non-zero with the
  offending entry named when a roster handle fails it. A malformed handle is a
  roster defect, so failing the scheduled refresh surfaces it rather than
  quietly publishing a substituted profile.
• Percent-encodes the handle at the interpolation point as defence in depth.
• Replaces the hand-rolled Authorization header with makeGitHubHeaders() from
  scripts/lib/github.mjs, so this call site inherits centralised auth
  handling the way scripts/collect-metrics.mjs does. The default
  User-Agent in that helper is the same cncf-endusers-site-build string
  that was inlined here, so request headers are unchanged.

Falsy handles keep their existing meaning: the two roster entries with
github: null are still skipped, not rejected.

Verification

• All 16 real handles in data/community-roster.json satisfy the new
  predicate, so the committed roster is unaffected and generated output is
  unchanged.
• node --test tests/ — 67/67 pass (55 before, 12 new).
• New tests/community-roster-handles.test.mjs runs entirely offline via the
  existing runScriptWithFixtures helper: every fixture entry uses
  github: null so no network request is ever issued, and only the rejected
  handle decides the exit status.
• npx prettier --check is clean on the new test file. The pre-existing
  prettier violations in scripts/fetch-community-people.mjs are left alone —
  they are present on main at 00b44df and reformatting the file would
  widen this diff into unrelated lines.

Scope / overlap

Claims scripts/fetch-community-people.mjs (the GITHUB_HANDLE predicate,
the header construction, and the fetch call) plus the new file
tests/community-roster-handles.test.mjs. Checked against the open PR set:

• [quality] test: cover scripts/fetch-community-people.mjs with an offline fetch stub (tests/fetch-community-people.test.mjs + tests/helpers-fetch-mock.mjs) #214 covers scripts/fetch-community-people.mjs with tests only
  (tests/fetch-community-people.test.mjs, tests/helpers-fetch-mock.mjs) and
  does not modify the script — disjoint files, though a reviewer landing both
  should note that this PR adds a fail-closed path for malformed handles.
• [quality] test: cover scripts/lib/github.mjs auth header and fetch error paths (tests/lib-github.test.mjs) #221 covers scripts/lib/github.mjs with tests only
  (tests/lib-github.test.mjs); this PR imports that module without changing
  it.
• [quality] test: cover data/community-roster.json contract (tests/community-roster-data.test.mjs) #241 covers data/community-roster.json with a contract test
  (tests/community-roster-data.test.mjs); this PR does not touch that data
  file.
• fix(community): validate profile website links before rendering #273 covers the rendering side of the blog field
  (src/components/CommunityPeople/index.js, src/lib/profile-links.mjs);
  this PR covers the fetch side and touches neither.

Closes #313

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-opus-5

[kubestellar-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "sec-check" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "sec-check". If this is an outreach PR, a human must review it and remove the label.