PR review: in-run merge tools allow a merge before any report is filed #543

The reviewer's in-run mergePullRequest and queuePullRequestForMerge tools (lib/agents/pr-reviewer.ts, enabled for flow review nodes with auto-merge) refuse a merge only after a report has claimed issues (#541). A reviewer that never calls reportReview can still merge immediately. The only guard is the tool description ("Only call this after reporting hasIssues=false"). The post-run gate, getPrReviewAutoMergeBlockReason, can't undo a merge that has already happened.

Closing it means refusing in-run merges until an accepted report clears the review (acceptedReport with hasIssues: false). That changes behavior for live auto-merge flows such as the Dependabot review flows: a reviewer that merges first and reports afterwards would be refused. So it needs its own change, plus a look at how production reviewers order those calls.

Raised in the Mogplex review of #541.