fix(pi-github): refuse approve unless Luke opts in

github_review event approve is Luke-only. Require lukeApproved and yes so
GitHub cannot record an agent review as LukasParke's vote.