Replace broken actions/first-interaction with an inline github-script

[tpvasconcelos]

Description

actions/first-interaction@v3 posts the "first pull request" greeting on every PR from any author who has never opened an issue in this repo — which in practice means every PR from pre-commit.ci, dependabot, and Copilot (#350, #355, #358, #362, #366, #374, #379, #380–#383, #395, ...). The v3 rewrite introduced two regressions: it ORs the first-issue/first-PR checks together instead of branching on the event type, and its first-PR check lost the per-author filter entirely. The bug also affects humans: any contributor who never filed an issue here would be re-greeted on every new PR. Upstream has been broken since Oct 2025 with no fix in sight.

This PR replaces the action with an inline actions/github-script@v9 step (already a dependency of other workflows here) that restores the correct v1 semantics and hardens the workflow:

• Never greet bots (user.type == "Bot": pre-commit.ci, dependabot, github-actions, Copilot, ...)
• Skip OWNER/MEMBER/COLLABORATOR authors cheaply (shortcut only — a missing/unreliable author_association falls through to the real check, so it can never cause a wrong greeting)
• Real detection matches v1: first issue = no earlier issues by the same creator; first PR = no earlier PRs by the same author (early-exit pagination)
• Keys off the resource author rather than the event sender (deterministic for agent-created PRs)
• Explicit least-privilege permissions: block (issues: write + pull-requests: write) instead of the repo-default write-all token
• Fail-soft: API errors log a warning instead of putting a red ❌ on a newcomer's first PR
• Security invariant documented in-file: pull_request_target with no checkout and no ${{ }}-interpolation of untrusted fields into the script source

Validation performed:

• All pre-commit hooks pass (incl. check-yaml, GitHub workflow schema validation, actionlint, and the timeout-minutes hook)
• The embedded script body was executed under Node (wrapped in an async function, as actions/github-script does) against mocked core/context/github objects replaying real scenarios: pre-commit-ci's [pre-commit.ci] pre-commit autoupdate #395, owner PRs, a repeat external contributor, a genuine first PR/issue, a second issue from the same reporter, a first issue from a previous PR author, and an API failure — 8/8 pass
• Decision logic cross-checked against live API data for every author category this repo has seen

Note: issues and pull_request_target workflows run the default-branch version, so this only takes effect after merging. The next pre-commit.ci autoupdate is the natural negative test; the next external contributor is the positive one.

Related issues

Upstream: actions/first-interaction#369 (broken first-contribution detection), actions/first-interaction#394 (request to ignore bots). Latest upstream release is still v3.1.0 (Oct 2025); both issues remain open.

PR check list

• Read the contributing guidelines.
• Provided the relevant details in the PR's description.
• Referenced relevant issues in the PR's description.
• Added tests for all my changes. (No Python code changed; the embedded script was behavior-tested under Node with mocked payloads — see description.)
• Updated the docs for relevant changes. (N/A — workflow-only change; no modules or public API touched.)
• Changes are documented in docs/reference/changelog.md. (Entry added in a follow-up commit referencing this PR's number.)
• Consider granting push permissions to your PR's branch. (Branch lives in this repo.)
• The CI check are all passing, or I'm working on fixing them!
• I have reviewed my own code! 🤠

---

📚 Documentation preview 📚: https://ridgeplot--398.org.readthedocs.build/en/398/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (4b7cf77) to head (e47ab56).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #398   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           19        19           
  Lines          674       674           
  Branches        88        88           
=========================================
  Hits           674       674           

Flag	Coverage Δ
combined-src	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.