maintainerconfig: add release.allowFork opt-in for fork auto-release

[bborbe]

Why

github-release-watcher drops forked repos during repo listing, upstream of the .maintainer.yaml trust gate, so a fork with release.autoRelease: true never releases (found on bborbe/tts-mcp). The fix needs a per-repo opt-in so an INHERITED .maintainer.yaml (forking a repo that already has autoRelease: true) does not silently enable auto-tagging on the fork.

This PR ships the schema half only: ReleaseConfig.AllowFork bool (yaml allowFork), defaulting false. The watcher's fork-listing half ships in a follow-up PR that will additionally require AllowFork: true before treating a fork as release-eligible.

Changes

• maintainerconfig/maintainerconfig.go: add AllowFork bool field to ReleaseConfig with GoDoc explaining the default-closed rationale.
• maintainerconfig/maintainerconfig_test.go: Ginkgo coverage — allowFork: true parses, absent field defaults false, combined autoRelease: true + allowFork: true (the headline fork-opt-in scenario), non-bool rejection, and ParseStrict acceptance now that the field is known.
• CHANGELOG.md: ## Unreleased bullet.
• Unrelated repo-health bump: github.com/klauspost/compress v1.18.6 → v1.18.7 (govulncheck GO-2026-5841) — needed to clear the make precommit vulncheck baseline.

Out of scope (this repo)

Watcher fork-filtering logic, any .maintainer.yaml content changes.

Test plan

• make precommit green (format, generate, test, lint, vet, vulncheck, osv-scanner, trivy, addlicense)
• maintainerconfig package at 100% test coverage
• Local /coding:pr-review-style pass run, findings fixed (see commit 99b770e)

[ben-s-pull-request-reviewer]

Now I have everything needed for adjudication. Let me compile the complete report.

Classification results:

• go-parse/paired-parse-and-parsedefault → applicable (ParseStrict at line 125 lacks a ParseStrictDefault counterpart)
• go-testing/suite-test-file-required → skipped (mechanical false positive — suite file maintainerconfig_suite_test.go exists)
• changelog/unreleased-entry-required → skipped (## Unreleased section exists with bullets)
• changelog/conventional-prefix-required → applicable (CHANGELOG.md changed) — passes, format is correct
• go-testing/libtime-injection-required → skipped (maintainerconfig.go has no time.Now() calls)

Adjudication of mechanical findings:

1. go-parse/paired-parse-and-parsedefault — ParseStrict (line 125) is exported and returns an error but has no ParseStrictDefault counterpart. The exemption for "internal parsing never exposed with a default" does not apply since ParseStrict is a public API function. The semantic counter-argument (strict/lax is the real pair; a "default" on strict parsing doesn't make sense) is a judgment call the rule leaves to the LLM, but the mechanical finding is technically correct per the rule's criteria.

2. go-testing/suite-test-file-required — mechanical false positive. maintainerconfig_suite_test.go exists in the same directory and contains TestSuite + RunSpecs. The LLM exemption check in the rule resolves this automatically.

No other violations found.

---

{
  "verdict": "approve",
  "summary": "PR adds the `release.allowFork` bool field to `ReleaseConfig` with good test coverage (5 new entries covering true/false/absent/absent-release-block cases), updates the vulnerable `github.com/klauspost/compress` dependency to v1.18.7, and updates CHANGELOG.md. One Should-Fix advisory: `ParseStrict` is exported with an error return but has no `ParseStrictDefault` counterpart — the semantic strict/lax pair (`Parse`/`ParseStrict`) exists but the rule also expects a `ParseXDefault` for callers who want a fallback-on-failure variant.",
  "comments": [
    {
      "file": "maintainerconfig/maintainerconfig.go",
      "line": 125,
      "severity": "major",
      "message": "Should Fix (go-parse/paired-parse-and-parsedefault): `ParseStrict` is exported and returns `(MaintainerConfig, error)` but has no paired `ParseStrictDefault(ctx, content, defaultValue) MaintainerConfig` counterpart. The rule's EXEMPT clause ('internal parsing never exposed with a default') does not apply since `ParseStrict` is a public API. Suggestion: either add `ParseStrictDefault` sharing `parseInternal`, or add a doc comment explicitly stating this package only needs the strict variant and the rule exemption applies. The semantic strict/lax pair (`Parse`/`ParseStrict`) already exists — the Default variant would serve callers who want a fallback on failure."
    }
  ],
  "concerns_addressed": [
    "correctness: AllowFork bool field added with yaml tag 'allowFork' — consistent with other bool fields (AutoRelease, ChangelogRewrite, AllowMajorBump)",
    "correctness: ParseStrict test added for allowFork: true — ParseStrict still correctly rejects unknown fields (existing test 'ParseStrict rejects typo in nested release field' covers this)",
    "security: AllowFork defaults false (field absent) — YAML bool zero-value coercion not a concern; explicit allowFork: true and allowFork: false both parse correctly per new test entries",
    "security: go.mod govulncheck GO-2026-5841 resolved by bumping github.com/klauspost/compress v1.18.6→v1.18.7 (patch, no API change)"
  ]
}