fix(merge gate): bind pr_merge and tbd_ship merges to the head commit the gate checked (TOCTOU)

The gate evaluates CI for one head sha; a push to the PR branch between that check and the merge would have merged
unchecked code. MergePRArgs now carries head_commit_id (documented in Gitea 1.27.1's MergePullRequestOption) and both
tools send the sha they evaluated. Tests for both tools; each removal flip-tested red.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM

internal/tools/pr_merge.go

@@ -97,9 +97,10 @@ func (t *PRMerge) Call(ctx context.Context, raw json.RawMessage) (json.RawMessag
 	}
 
 	if err := t.c.MergePullRequest(ctx, args.Owner, args.Repo, args.Number, gitea.MergePRArgs{
-		Do:    style,
-		Title: args.Title,
-		Body:  args.Body,
+		Do:           style,
+		Title:        args.Title,
+		Body:         args.Body,
+		HeadCommitID: pr.Head.Sha,
 	}); err != nil {
 		return nil, err
 	}