Previously `knot.go` executed every `sh.tangled.pipeline` event the moment it arrived, ignoring the `spindle_members` and `repos` tables that `jetstream.go` has been mirroring from the AT Proto firehose. The knot consumer now consults `store.AuthorizePipelineActor` before dispatching a trigger. The check has two gates: the triggers repo must have published a `sh.tangled.repo` record naming us as its spindle on the knot the event arrived from, and the publisher of that repo record must be either the spindle owner or a subject the owner vouched for via `sh.tangled.spindle.member`.