feat: canonical cleanup for stale #332 review decision locks (#594)

Durable review-decision locks (#559) can outlive the PR they protect.
When the last terminal mutation references a PR that is already
merged/closed, expose gitea_cleanup_stale_review_decision_lock so a
reviewer can clear the lock with identity/profile gates and a durable
audit trail — without weakening #332 for open PRs or deleting
session-state files by hand.

Also auto-clear same-profile locks after a successful merge of the
approved PR, and document allowed vs forbidden cleanup.

Closes #594

task_capability_map.py

@@ -96,6 +96,17 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.pr.approve",
         "role": "reviewer",
     },
+    # #594: clear durable #332 decision lock only when last terminal PR is
+    # already merged/closed (moot). Apply path requires reviewer review
+    # permission; assessment itself uses gitea.read inside the tool.
+    "cleanup_stale_review_decision_lock": {
+        "permission": "gitea.pr.review",
+        "role": "reviewer",
+    },
+    "gitea_cleanup_stale_review_decision_lock": {
+        "permission": "gitea.pr.review",
+        "role": "reviewer",
+    },
     "delete_branch": {
         "permission": "gitea.branch.delete",
         "role": "author",