fix: resolve conflicts for PR #422

Re-merge current prgs/master after #424/#407 landed. Combine workflow-load
boundary session proof (#403/#389) with reviewer PR lease test fixtures
from master so reviewer mutation gates stay fully covered.

skills/llm-project-workflow/workflows/review-merge-pr.md

@@ -770,6 +770,26 @@ The final report must identify:
 * whether same-PR merge continuation was allowed
 * whether the run stopped as required
 
+## 26B. Per-PR reviewer lease (#407)
+
+Parallel reviewer sessions are allowed only when each session holds a distinct,
+live PR lease.
+
+Before validation or review mutation on a selected PR:
+
+1. Call `gitea_acquire_reviewer_pr_lease` with worktree path, candidate head SHA,
+   and target branch SHA.
+2. Post heartbeats via `gitea_heartbeat_reviewer_pr_lease` before validation,
+   after validation, before review mutation, and before merge.
+3. Do not approve, request changes, or merge unless the in-session lease
+   matches the selected PR.
+
+If PR head or target branch advances during the lease, stop and refresh
+inventory before continuing.
+
+Final reports must include lease session id, acquisition proof, heartbeat
+status, and release/blocked status.
+
 ## 27. Merge rules
 
 Before merge, rerun fresh live checks: