Combine member updates and guarded deletes

[galargh]

Summary

This draft PR combines the work from:

• Add member update workflow #263: Add member update workflow
• Guard repository and membership deletes #264: Guard repository and membership deletes

It also includes follow-up improvements introduced in this branch:

• Keep routine Fix PR comments focused on access changes only, while publishing the full access report as the Fix workflow summary/artifact.
• Link access-change comments to the Fix workflow run so reviewers can inspect the full access breakdown when needed.
• Explain repository access paths in access changes and reports, distinguishing direct access from team-granted access.
• Flag members with no effective repository access as potential no members, even if they are in teams without repository access.
• Fail Plan/Apply classification when removing an organization member would leave team membership or direct private repository access behind.
• Require ALLOW_DESTROY=true on allow-destroy environments before disabling Terraform prevent_destroy.
• Document the access changes action update requirement and allow-destroy environment variable setup.

Validation

• pnpm --dir scripts install --frozen-lockfile
• pnpm --dir scripts run format
• pnpm --dir scripts run lint
• pnpm --dir scripts run build
• pnpm --dir scripts test