[ci] Azure Pipelines '/azp run' fails for external contributors — 'does not have sufficient privileges'

[rustiqly]

Description

/azp run Azure.sonic-buildimage fails with:

Commenter does not have sufficient privileges for PR $N in repo sonic-net/sonic-buildimage

This blocks CI for external contributor PRs. The error started occurring around mid-February 2026 — earlier /azp run commands on the same PRs succeeded.

Affected PRs (all from @rustiqly):

• Add SONIC_CONFIG_USE_DOCKER_CACHE to allow Docker layer caching #25620 — Docker layer caching config
• [pmon] Strip debug symbols from grpc native extensions #25627 — Strip PMON grpc debug symbols
• [build] Add build timing report and dependency analysis tools #25643 — Build timing report + dep analysis
• [build] Auto-detect SONIC_CONFIG_BUILD_JOBS from CPU and RAM #25644 — Auto-detect SONIC_CONFIG_BUILD_JOBS
• [build] Add INCLUDE_PTF config to skip PTF test containers #25646 — INCLUDE_PTF skip PTF containers
• [build] Replace mkdir/sleep polling locks with flock for dpkg and pip installs #25648 — flock install locks
• [build] Add ccache support for C/C++ compilation (SONIC_CONFIG_USE_CCACHE) #25650 — ccache support
• [initramfs-tools] Replace git clone with pinned tarball + SHA256 #25664 — Pin initramfs-tools
• [rasdaemon] Pin git clone to specific commit hash for reproducibility #25668 — Pin rasdaemon
• [cache] Reduce cache invalidation scope with SONIC_CACHE_RECIPE_VER #25697 — Cache invalidation scope (approved by @yxieca, blocked on CI)
• [build] Add make clean-docker target for stale image cleanup #25706 — clean-docker target

Note: Newer PRs (#25704, #25707, #25708) from the same contributor got Azure CI automatically, so this may be specific to PRs created before a certain date or after too many /azp run retries.

Expected behavior

External contributors should be able to trigger Azure Pipelines via /azp run, or CI should trigger automatically on push.

Steps to reproduce

1. Comment /azp run Azure.sonic-buildimage on any of the affected PRs
2. Observe 'does not have sufficient privileges' error