feat: guarded merger lease adoption flow (#536)

Replace manual in-process _SESSION_LEASE seeding with an auditable
gitea_adopt_merger_pr_lease tool that posts durable adoption proof and
records sanctioned session provenance. Mutation gates now reject bare
record_session_lease calls without provenance from acquire/adopt/heartbeat.

Closes #536

tests/test_reviewer_pr_lease.py

@@ -7,6 +7,7 @@ from unittest.mock import patch
 
 sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))
 
+import merger_lease_adoption as mla
 import reviewer_pr_lease as leases
 
 
@@ -123,7 +124,11 @@ class TestReviewerLeaseMutationGate(unittest.TestCase):
             "session_id": "my-session",
             "candidate_head": head,
             "target_branch": "master",
-        })
+            "comment_id": 101,
+        }, lease_provenance=mla.build_lease_provenance(
+            source=mla.SOURCE_ACQUIRE,
+            comment_id=101,
+        ))
         result = leases.assess_mutation_lease_gate(
             pr_number=382,
             comments=comments,
@@ -143,7 +148,11 @@ class TestReviewerLeaseMutationGate(unittest.TestCase):
             "pr_number": 382,
             "session_id": "my-session",
             "candidate_head": reviewed,
-        })
+            "comment_id": 102,
+        }, lease_provenance=mla.build_lease_provenance(
+            source=mla.SOURCE_ACQUIRE,
+            comment_id=102,
+        ))
         result = leases.assess_mutation_lease_gate(
             pr_number=382,
             comments=comments,