fix(merge gate): bind pr_merge and tbd_ship merges to the head commit the gate checked (TOCTOU)

The gate evaluates CI for one head sha; a push to the PR branch between that check and the merge would have merged
unchecked code. MergePRArgs now carries head_commit_id (documented in Gitea 1.27.1's MergePullRequestOption) and both
tools send the sha they evaluated. Tests for both tools; each removal flip-tested red.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM

internal/gitea/pulls.go

@@ -109,6 +109,8 @@ type MergePRArgs struct {
 	Do    string `json:"Do"`
 	Title string `json:"merge_message_title,omitempty"`
 	Body  string `json:"merge_message_field,omitempty"`
+	// HeadCommitID binds the merge to the commit whose CI was checked: if the PR branch moved, Gitea refuses.
+	HeadCommitID string `json:"head_commit_id,omitempty"`
 }
 
 func (c *Client) MergePullRequest(ctx context.Context, owner, repo string, index int, args MergePRArgs) error {