fix(strix): use trusted event visibility before API lookup #1319

LineageWeave and sibling repositories can fail the required Strix check before scanning when the required-workflow token cannot read the target repository metadata, even though pull-request and repository events already carry trusted visibility.

Acceptance criteria:

• ordinary pull-request, push, and scheduled scans derive public/private routing from trusted event metadata without an API call;
• private and internal repositories remain on private-capable providers;
• repository_dispatch keeps bounded live API validation;
• malformed visibility fails closed;
• actionlint, shell syntax, targeted Strix contract checks, and exact-head hosted checks pass.

Observed evidence: ContextualWisdomLab/LineageWeave#600 exact head 7580bdc94cd73360a363b19f2e3e7562c4efd538 failed strix because visibility did not resolve after six API retries.