A missing org grant reds every PR at once — hoist repo-scoped assertions out of the per-PR arm lane

Arm auto-merge on this PR fails on every open PR simultaneously because the meshweaver-cloud App lacks pull_requests: write. Variance zero: it says nothing about any PR and hides the reds that do. The assertion belongs in one repo-scoped lane. Fixed by the linked PR.