fix(workflow): durable HMAC, dedicated mint capability, head-exact approve match (#709)

Address formal review 435 REQUEST_CHANGES on PR #710:
- F4: require durable GITEA_IRRECOVERABLE_AUTH_HMAC_KEY (fail closed; no ephemeral
  per-process secret); bind key_version into HMAC; cross-process verify works
- F5: dedicated gitea.decision_lock.irrecoverable_recovery only; reject reconciler
  equivalence; authoritative incident body + author + content_digest; reject
  self-authored incident evidence
- F3 residual: lock_targets_merged_pr_approval requires recorded-head match when
  expected_head_sha is provided (legacy no-head approve no longer primary-clears)

Co-Authored-By: Grok 4.5 (xAI) <[email protected]>

stale_review_decision_lock.py

@@ -504,7 +504,13 @@ def lock_targets_merged_pr_approval(
     pr_number: int,
     expected_head_sha: str | None = None,
 ) -> bool:
-    """True when *lock*'s last terminal mutation is approve of *pr_number*."""
+    """True when *lock*'s last terminal mutation is approve of *pr_number*.
+
+    When *expected_head_sha* is provided, a **recorded** terminal head must
+    match. Legacy same-repo approve locks with no recorded head do **not**
+    match (fail closed, #709 F3 residual / review 435) — callers must use the
+    strict secondary path that refuses no-head clears.
+    """
     last = last_terminal_mutation(lock)
     if last is None:
         return False
@@ -513,8 +519,12 @@ def lock_targets_merged_pr_approval(
     if last.get("pr_number") != pr_number:
         return False
     if expected_head_sha:
+        want = normalize_head_sha(expected_head_sha)
+        if not want:
+            return False
         locked = mutation_head_sha(last, lock)
-        if locked and not heads_equal(locked, expected_head_sha):
+        # Require recorded-head match; unrecorded head is not a match (#709 F3).
+        if not locked or not heads_equal(locked, want):
             return False
     return True