Merge master into fix/issue-714-session-context-immutability

Resolve gitea_mcp_server.py conflicts after master advanced with #724
(side-effect-free resolver), #725 (merger lease), #728 (PR-sync), and
#702 stale-binding recovery:

- Keep #714 fail-closed session immutability: no auto profile switch
  (_ensure_matching_profile / _try_auto_switch_for_operation).
- Retain master #709 _authenticated_actor identity helper.
- Preserve resolve-path auto_recover=False (#685) and report-only
  stale_binding_recovery coexistence with runtime_reconnect_required.
- Cross-host / cross-repository substitution still fails closed without
  mutating the pinned session context.
- Regression coverage for merge coexistence, dual-module identity-cache
  isolation in conftest, and structured unknown_task fail-closed.

Closes #714 conflict remediation path for PR #715.

tests/test_stale_review_decision_lock_cleanup.py

@@ -184,20 +184,32 @@ class TestActiveHardStopPreserved(unittest.TestCase):
         mcp_server._save_review_decision_lock(None)
         mcp_server.review_workflow_load.clear_review_workflow_load()
 
-    def test_open_approve_still_blocks_other_pr_mark_ready(self):
-        _seed([APPROVED_OPEN])
-        reasons = mcp_server.terminal_review_hard_stop_reasons(592, "mark_ready")
-        self.assertTrue(reasons)
-        self.assertIn("#332", reasons[0])
-        self.assertIn("gitea_cleanup_stale_review_decision_lock", reasons[0])
+    def test_open_approve_blocks_same_pr_not_other_pr_mark_ready(self):
+        _seed([APPROVED_OPEN])  # approve on PR #700
+        # Same PR still hard-stopped for mark_ready.
+        reasons_same = mcp_server.terminal_review_hard_stop_reasons(
+            700, "mark_ready"
+        )
+        self.assertTrue(reasons_same)
+        self.assertIn("#332", reasons_same[0])
+        # #693: other PR may mark_ready without cleanup.
+        self.assertEqual(
+            mcp_server.terminal_review_hard_stop_reasons(592, "mark_ready"),
+            [],
+        )
 
-    def test_request_changes_still_blocks_everything(self):
-        _seed([RC_OPEN])
+    def test_request_changes_still_blocks_same_pr(self):
+        _seed([RC_OPEN])  # request_changes on PR #701
         for op in ("merge", "mark_ready", "review"):
             self.assertTrue(
-                mcp_server.terminal_review_hard_stop_reasons(592, op),
+                mcp_server.terminal_review_hard_stop_reasons(701, op),
                 msg=op,
             )
+        # Foreign PR review path is open (#693).
+        self.assertEqual(
+            mcp_server.terminal_review_hard_stop_reasons(592, "mark_ready"),
+            [],
+        )
 
 
 # --------------------------------------------------------------------------- #