conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository

An attacker monitors GitHub for usernames that have been freed (e.g., after a maintainer changes their username) and that still have pending conda-forge repository invitations. By registering the freed username, the attacker becomes the recipient of any future invitations tied to that old username. Accepting the invitation grants unintended write access to the associated feedstock repository, enabling supply-chain compromise [ref_id=2]. The root cause is the use of mutable GitHub usernames as identifiers instead of immutable GitHub user IDs [CWE-287].

The vulnerability resides in the `configure_github_team` function within `conda-smithy`. The original code routed repository invitations and team membership based on GitHub usernames (mutable strings) rather than immutable GitHub user IDs. The patch introduces a durable mapping file (`.recipe_maintainers.json`) and checks that a username's current GitHub user ID matches the previously recorded ID before granting access [ref_id=1][ref_id=2].

The patch introduces a durable mapping file (`.recipe_maintainers.json`) stored in each feedstock repository that records the GitHub user ID associated with each maintainer username. Before adding a new maintainer to the GitHub team, the code now fetches the current user ID for that username and compares it against the previously recorded ID. If the IDs do not match, the user is not added, preventing a new registrant of a recycled username from gaining access. The same ID check is used when removing maintainers, ensuring that legitimate username changes are not treated as removals [ref_id=1].