fix(git-sync): run auto-pull as the admin who enabled it (#11121)

* fix(git-sync): run auto-pull as the admin who enabled it

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(git-sync): audit the admin grant fork pulls make

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore: bump ee ref for the post-commit fork grant audit

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(git-sync): address review nits on the auto-pull stamp

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore: update ee-repo-ref to ccada062c072d7b74894b63863728fd1ef9bdffd

This commit updates the EE repository reference after PR #799 was merged in windmill-ee-private.

Previous ee-repo-ref: 7cee30f0cf12721cba551cd754dc817444810470

New ee-repo-ref: ccada062c072d7b74894b63863728fd1ef9bdffd

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

docs/git-sync-pull-design.md

@@ -186,6 +186,35 @@ Routing — an event/poll result is `(repo, ref, head_sha, sender)`:
   filters): fan out, each workspace pulls with its own filters; `wmill.yaml` in
   the repo stays authoritative for include/exclude.
 
+Identity — a pull applies changes as a real workspace admin, never a reserved identity.
+The schedules, triggers and app policies it deploys persist their deployer as the identity
+they run as, and `validate_on_behalf_of` refuses reserved sentinels there, so a real admin
+is what keeps those deployable and revocable (demote or remove the admin and what runs
+under them stops).
+
+- The admin is `auto_pull.enabled_by`, stamped server-side with the email of whoever last
+  saved the git sync settings with auto pull on. Re-saving as another admin rotates it.
+- A stamp naming someone who is no longer an active admin (demoted, or deactivated in the
+  workspace or on the instance), and not an active instance superadmin either, fails the
+  pull rather than falling back to someone else. A superadmin who is not a member runs it
+  under their instance username, and only while no member of the workspace holds that
+  username: `u/<username>` resolves through the workspace's members before the email. A
+  repository whose settings predate the stamp runs as the workspace's first active admin
+  until they are saved again.
+- The identity is resolved before the deploy check is posted, and a failure to resolve it
+  or to enqueue is recorded on the repository's status, not returned: a returned error
+  would fail the webhook delivery, and hosts disable hooks whose deliveries keep failing.
+  The next push or poll retries.
+- Fork pulls run as the parent repository's identity, stamped or not, resolved in the
+  parent (revoking that admin there stops fork pulls too), and first add that admin to
+  the fork as an admin member, since a plain fork carries only its creator. The fork's
+  owner cannot be the identity: a non-admin's `wmill sync push` diffs against what it can
+  see, so an item in a folder it cannot read reads as a create and the push fails on every
+  commit. CI tests do run as the owner (Phase 7), because they only execute.
+- Known and accepted: repo writers control the pull's includes through `wmill.yaml`, so a
+  fork's owner can commit a user file that makes them admin of the fork and read the
+  parent secrets it cloned, as with the `push-on-merge-to-forks` Action this replaces.
+
 Loop prevention (pull → deploys → deployment callback → commit → push event):
 
 1. Skip events whose sender is the app bot (`windmill-sync-helper[bot]` /