[saubyk]

Repin the gateway shim to v0.7.2.

Both pins move together

	From	To
uses: lightninglabs/gateway-action@	a590b98 (v0.7.1)	254f0cb (v0.7.2)
runtime_ref:	2c05e70 (gateway v0.7.1)	abe5c3a (gateway v0.7.2)

The v0.7.2 runtime needs the job token that gateway-action v0.7.2 passes, so these two pins must move in the same change: bumping only runtime_ref would make every command fail, and bumping only uses: would keep running the previous runtime.

No trigger, input, permission, secret, event or timeout changes.

What v0.7.2 brings

• Permission check before any credentials. A /gateway command is now checked against the commenter's permissions before the job installs Claude or touches the App key or Claude credentials. A command that isn't allowed loads nothing and mints no token. It gets no reply; the reason is in the workflow log (authorize / skipped).
• /gateway explain needs a maintainer or the PR author. It used to be open to anyone on GitHub, and each explain is a Claude call.
• Repeat guards. Explaining the same finding again within 10 minutes is refused with a short reply. Checking the same commit again within 10 minutes gets a 👀 reaction and no new comment. Both are refused before any Claude call. GATEWAY_EXPLAIN_COOLDOWN_SECONDS and GATEWAY_CHECK_COOLDOWN_SECONDS in the job's env change the windows (0 turns a guard off).

Optional: skip outsiders' comments

The gateway shim template now has a job if: filter that skips /gateway comments from anyone who is neither OWNER/MEMBER/COLLABORATOR nor the PR author, so they don't start a runner. It isn't added here. Before adding it, check that every maintainer who uses /gateway has public org membership: a private member can show up as CONTRIBUTOR, and their commands would be skipped silently.