fix: await issue comment side effects

[thc1006]

Description

Several command handlers start a label or comment write and then return without awaiting it. handleIssueComment does await area(context), but area resolves as soon as its synchronous body finishes, before the write it started has settled. A failed write then rejects after the handler already resolved, so the hub's existing .catch never sees it and the rejection escapes unhandled. The Action does not fail through core.setFailed, and on current Node an unhandled rejection terminates the worker.

This awaits the writes in area, kind, priority, hold, lgtm, and approve (including the two paths that comment when a user is not authorized), and awaits the dispatch so a rejection reaches core.setFailed. It also normalizes non-Error rejections from the issue-comment command handlers, while the top-level dispatcher reports any non-Error handler rejection through core.setFailed. Command concurrency and semantics are unchanged; the calls just wait for their own results. The entrypoint is split so run() lives in src/run.ts and src/main.ts only invokes it, which lets the dispatch be unit-tested without a module-load side effect.

Fixes #102

Why the existing tests did not catch it

The label tests await handleIssueComment(...) and then await observeReq.called(), which proves the request was eventually made but not that the handler waited for it. The added tests close that. One holds the label write open behind a gate and asserts the handler stays pending until it settles. Another makes the write return 500 and asserts core.setFailed is called with the write error. A module-level test drives run() with a mocked handler to prove src/run.ts awaits the dispatch, and an lgtm test proves that when the unauthorized reply itself fails the Action still surfaces the authorization error. Each of these fails when its await is removed.

Scope

No dependencies, parser changes, label behavior, or command ordering were touched. dist/index.js is regenerated with npm run pack, which also brings the bundled transitive brace-expansion in sync with the unchanged lockfile (the committed bundle was stale); no dependency versions changed.

Testing

• npm run all passes (build, lint, pack, test): 84 passing, 6 skipped
• area: the handler stays pending until the write settles, and a failed write reaches core.setFailed with the write error
• run: src/run.ts awaits the dispatched handler and surfaces its rejection
• lgtm: a failed unauthorized reply still fails with the authorization error
• confirmed each new test fails when its await is removed

Checklist:

• I ran npm run all to lint and build my code
• No new dependencies
• I have performed a self review of my own code
• I have commented my code, particularly in hard to understand areas
• I have made corresponding changes to the documentation (no documentation changes needed)
• My changes generate no new warnings