fix: isolate #519 PR lookup from shared lease comment listing

Keep _fetch_pr_lease_comments_safe for gitea_assess_conflict_fix_push
only. Restore _list_pr_lease_comments to a single comments GET so merge
approval feedback and #485 non-list handling keep stable API call order.

Closes #519

gitea_mcp_server.py

@@ -2940,16 +2940,25 @@ def _list_pr_lease_comments(
     repo: str | None,
     limit: int = 100,
 ) -> list[dict]:
-    """Fetch PR/issue thread comments used for reviewer/conflict-fix leases."""
-    fetched = _fetch_pr_lease_comments_safe(
-        pr_number,
-        remote=remote,
-        host=host,
-        org=org,
-        repo=repo,
-        limit=limit,
-    )
-    return fetched["comments"]
+    """Fetch PR/issue thread comments used for reviewer/conflict-fix leases.
+
+    Intentionally does **not** pre-fetch the PR via GET /pulls/{n}. Shared
+    callers (merge approval feedback, reviewer lease gates) depend on a single
+    comments GET so mock sequences and fail-open #485 non-list handling stay
+    stable. Structured PR-lookup failures belong only to
+    :func:`_fetch_pr_lease_comments_safe` used by conflict-fix push assessment
+    (#519).
+    """
+    h, o, r = _resolve(remote, host, org, repo)
+    auth = _auth(h)
+    api = f"{repo_api_url(h, o, r)}/issues/{pr_number}/comments"
+    comments = api_request("GET", api, auth)
+    # Fail safe to no lease comments when the API returns a non-list payload
+    # (e.g. an error object such as an HTTP 401 body): lease state can only be
+    # proven from real comment entries, never inferred from an error shape (#485).
+    if not isinstance(comments, list):
+        return []
+    return list(comments[:limit])
 
 
 def _pr_work_lease_reviewer_block(