Review Wall of Apps pull requests

Treat Wall submissions as untrusted external contributions while keeping the legitimate-app path fast.

Discover and classify

1. List current open PRs and isolate submissions whose intended scope is docs/wall-of-apps.json.
2. Inspect each PR's full file list and diff before checkout. Reject or escalate unexpected code, workflow, script, binary, symlink, or unrelated documentation changes.
3. Review each PR independently and merge sequentially so every later PR is validated against the real current base.

Validate the entry

For every added or changed app: