fix(bug-fix): accept workflow-authored assessment comments from bot/service accounts

Address the open Copilot finding on assessment-author matching.

The workflow previously required the prior assessment comment to be authored by
`github-actions[bot]`. That is too strict for portable repos where bug-assess
may post through a different bot/service account token.

Updated Step 1 to select the most recent assessment comment that appears
workflow-authored by combining:
- bot/service-account authorship, and
- expected bug-assess structure (assessment header plus remediation/files/tests sections).

This keeps the spoof-resistance intent while removing dependence on one fixed
login.

Recompiled with gh-aw v0.79.8 and kept checkout v7.0.0 pin fixups.

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: BenBtg

.github/workflows/bug-fix.lock.yml

@@ -76,7 +76,12 @@ whose first line has the shape:
 **Bug assessment — <slug>:** <Valid | Likely valid, needs reproduction | Invalid> · severity **<critical | high | medium | low>**
 ```
 
-Find the **most recent** such assessment comment **authored by `github-actions[bot]`** (the `bug-assess` workflow). If there is more than one, use the latest workflow-authored one. If no workflow-authored assessment exists, follow the "no assessment" path below.
+Find the **most recent** such assessment comment that appears
+**workflow-authored**: the author is a **bot/service account** and the comment
+matches the expected `bug-assess` structure (assessment header plus sections
+like **Proposed Remediation**, **Files likely to change**, and **Tests to add or
+update**). If there is more than one, use the latest matching one. If no
+workflow-authored assessment exists, follow the "no assessment" path below.
 If **no** assessment comment exists on the issue:
 
 1. Add **one** comment explaining that a fix cannot be proposed because no