pre-review: dismiss the review bot's stale approval at review run start (follow-up to #1719) #1720

Problem

Follow-up to fullsend-ai/fullsend#5417 and #1719. #1719 removes ready-for-merge at review run start. The review bot's own GitHub APPROVED review still has the same gap: after a push, it stays in effect until the next review run finishes.

The dismissal exists, but it only runs at the end. fullsend post-review calls dismissStaleApprovals after it posts the new verdict (fullsend internal/cli/postreview.go, around lines 446-483). Between the push and the end of the next review, a repo whose branch rules count the bot's approval can merge the new head on the old approval.

Change (minimum, same layer as #1719)

1. In scripts/pre-review.src.sh, right after the ready-for-merge removal, dismiss APPROVED reviews on the PR that were submitted by the review bot identity using REVIEW_TOKEN. Do not touch reviews by other users. Use a message like "Superseded: new review run started".
   • Add a forge helper in scripts/lib/github-review-ops.lib.sh, for example forge_dismiss_own_approvals.
   • Find the bot login the same way post-review does, from the token's own identity. Do not hard-code app names.
   • GitLab: no-op unless the review app's approval maps to a GitLab MR approval. If it does, revoke it with the same token. Otherwise document the no-op.
2. Fail closed in the same way as fix(#1718): clear ready-for-merge at review run start #1719. A failed list or dismiss logs a ::warning:: and does not block the review. Print a notice only when a dismissal succeeds.
3. make script-build, and commit the bundles. make check-bundle must pass.
4. Tests in scripts/pre-review-test.sh:
   • a bot APPROVED review is dismissed;
   • an APPROVED review by another user is left alone;
   • there are no reviews, so no dismissal call is made;
   • a failed dismissal produces a warning and no success notice.
5. Add one sentence to docs/review.md next to the ready-for-merge sentence.

Out of scope

• Workflow files (reusable-dispatch.yml). Pushes that do not start a review run keep the approval. Repos that need a hard gate should enable GitHub's "Dismiss stale pull request approvals when new commits are pushed".
• Skipping re-review on rebase-only pushes. That is tracked in Review agent should detect rebase-only force-pushes and skip re-review when the effective diff is unchanged fullsend#4401 and Short-circuit review on rebase-only pushes to avoid redundant sub-agent dispatch #108.

Acceptance

• make script-test and make check-bundle pass.
• On a test repo, a push to a PR the bot approved: the review run's pre-script dismisses the bot's approval before the sandbox starts. A new approval appears only if the new run approves.