fix: isolate #519 PR lookup from shared lease comment listing

Keep _fetch_pr_lease_comments_safe for gitea_assess_conflict_fix_push
only. Restore _list_pr_lease_comments to a single comments GET so merge
approval feedback and #485 non-list handling keep stable API call order.

Closes #519

tests/test_pr_lease_comments_non_list_guard.py

@@ -16,31 +16,26 @@ AUTHOR_ENV = {
     "GITEA_PROFILE_NAME": "gitea-author",
     "GITEA_ALLOWED_OPERATIONS": "gitea.read,gitea.issue.comment",
 }
-OPEN_PR = {"number": 12, "state": "open", "head": {"sha": "abc123"}}
-
-
-def _pr_then_comments(mock_api, comments_payload):
-    def _api(method, url, auth, *args, **kwargs):
-        if "/pulls/" in url:
-            return OPEN_PR
-        return comments_payload
-
-    mock_api.side_effect = _api
 
 
 class TestPrLeaseCommentsNonListGuard(unittest.TestCase):
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_list_pr_lease_comments_non_list_payload_returns_empty(self, _auth, mock_api):
-        _pr_then_comments(mock_api, {"message": "Unauthorized"})
+        mock_api.return_value = {"message": "Unauthorized"}
         result = _list_pr_lease_comments(
             12, remote="prgs", host=None, org=None, repo=None)
         self.assertEqual(result, [])
+        # Single comments GET only — no pre-flight PR lookup (#519 isolation).
+        mock_api.assert_called_once()
+        _method, url, _auth_arg = mock_api.call_args[0][:3]
+        self.assertIn("/issues/12/comments", url)
+        self.assertNotIn("/pulls/", url)
 
     @patch("mcp_server.api_request")
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_list_pr_lease_comments_none_returns_empty(self, _auth, mock_api):
-        _pr_then_comments(mock_api, None)
+        mock_api.return_value = None
         result = _list_pr_lease_comments(
             12, remote="prgs", host=None, org=None, repo=None)
         self.assertEqual(result, [])
@@ -49,7 +44,7 @@ class TestPrLeaseCommentsNonListGuard(unittest.TestCase):
     @patch("mcp_server.get_auth_header", return_value=FAKE_AUTH)
     def test_list_pr_lease_comments_list_payload_unchanged(self, _auth, mock_api):
         comment = {"id": 7, "body": "<!-- mcp-review-lease:v1 -->"}
-        _pr_then_comments(mock_api, [comment])
+        mock_api.return_value = [comment]
         result = _list_pr_lease_comments(
             12, remote="prgs", host=None, org=None, repo=None, limit=5)
         self.assertEqual(result, [comment])
@@ -83,4 +78,4 @@ class TestPrLeaseCommentsNonListGuard(unittest.TestCase):
 
 
 if __name__ == "__main__":
-    unittest.main()
+    unittest.main()