ci: cache-write hygiene and CLA allowlist for the maintenance agent (#288)