feat: require approval at current PR head for merge (#471)

Add merge_approval_gate assessment so gitea_merge_pr fails closed when
visible APPROVED reviews do not pin the live head SHA. Expose
approval_at_current_head and stale_approval_block_reason in review
feedback. Document re-review requirement in canonical merge workflow.

Closes #471.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

tests/test_audit.py

@@ -313,7 +313,8 @@ class TestGatedToolAudit(_AuditWiringBase):
             {"login": "merger-bot"}, self._pr("author-bot"),
             self._pr("author-bot"),
             [{"id": 1, "user": {"login": "reviewer-bot"}, "state": "APPROVED",
-              "submitted_at": "2026-07-06T10:00:00Z", "dismissed": False}],
+              "commit_id": "abc123", "submitted_at": "2026-07-06T10:00:00Z",
+              "dismissed": False}],
             {}, {"merged_commit_sha": "c1"},
         ]
         env = self._env(GITEA_PROFILE_NAME="gitea-merger",