Add osac-ci-bot to fulfillment-wg

[eliorerz]

Problem

osac-ci-bot runs the merge-queue automation in osac-project/osac:

• auto-queue.yml: removes lgtm on push, dismisses changes-requested reviews, checks collaborator status, enables/disables auto-merge
• konflux-auto-label.yml: labels Konflux dependency-bump PRs

It wasn't a member of any team here, so it had no path to elevated repo access and fell back to the org default (read). A fine-grained PAT owned by this account can never exceed its actual collaborator role, regardless of what permissions the token itself requests — confirmed live against the real API: every mutating call (label add, review dismiss, collaborator check, auto-merge enable/disable) returned 403, even after configuring the token's own fine-grained permissions correctly (Contents: write, Pull requests: write, Administration: read) and getting it approved by an org owner.

Fix

One line: add osac-ci-bot to fulfillment-wg in team-members/fulfillment-wg.csv. That team already grants push on osac, osac-test-infra, and github-config (among others) — matching what the existing MERGE_QUEUE_TOKEN (a personal token) effectively has today. osac-dev-bot, another bot account, is already a plain member of this same team, so this isn't a new pattern.

Verification

• tofu fmt -check — clean (no formatting changes needed, plain CSV edit)
• tofu validate — succeeds (only pre-existing, unrelated deprecation warnings)
• Confirmed osac-ci-bot is already an org member (members.csv) and not currently in any team (team-members/*.csv) before this change
• Confirmed via the live API (GET /repos/osac-project/osac/collaborators/osac-ci-bot/permission) that its current effective permission is read, consistent with having no team-based grant anywhere

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• team-members/fulfillment-wg.csv is excluded by !**/*.csv

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a19b7a64-1a2a-4af8-94fc-d6b04ff5f73f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}