fix: address PR Agent review findings across 6 files

Restrict PR Agent workflow to trusted collaborators on PR comments only,
fix UTF-8 byte counting in gallery-pack, correct portrait-to-landscape
fallback orientation, track inserted freeform beats in visitedBeatIds,
allow clearing stored TTS key, and guard empty-string fuzzy match in
style selector.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/pr-agent.yml

@@ -11,7 +11,9 @@ jobs:
     if: >
       github.event_name == 'pull_request' ||
       (github.event_name == 'issue_comment' &&
-       startsWith(github.event.comment.body, '/'))
+       github.event.issue.pull_request &&
+       startsWith(github.event.comment.body, '/') &&
+       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
     runs-on: ubuntu-latest
     permissions:
       issues: write
@@ -36,7 +38,9 @@ jobs:
     if: >
       github.event_name == 'pull_request' ||
       (github.event_name == 'issue_comment' &&
-       startsWith(github.event.comment.body, '/'))
+       github.event.issue.pull_request &&
+       startsWith(github.event.comment.body, '/') &&
+       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
     runs-on: ubuntu-latest
     permissions:
       issues: write