Only count reviews made against the current head commit

[simongdavies]

What

Counts approvals and change requests only when the review was submitted against the current head commit of the pull request. Reviews made before the latest push are treated as stale and ignored.

Why

The engine removes the ready-for-review label when a PR has >= 2 approvals or >= 2 change requests. Previously a reviewer's CHANGES_REQUESTED (or APPROVED) review kept counting even after the author pushed fixes, because re-requesting a review does not reset the existing review state.

That broke the documented re-review flow: after addressing two change requests, an author pushes an update and re-adds ready-for-review for a re-review, but the next workflow trigger (e.g. an unrelated review comment, which fires pull_request_review: submitted) saw the two stale change requests still at threshold and stripped the freshly-added label.

GitHub does not dismiss CHANGES_REQUESTED reviews on push, so we replicate its stale-review semantics ourselves.

How

• The GraphQL query now also fetches headRefOid and each review's commit { oid }.
• Both the approval and change-request counts keep only reviews whose commit.oid matches headRefOid (a null oid never matches, so it is treated as stale).
• Filtering is applied symmetrically to approvals and change requests for consistency: pushing a new commit resets both counts until reviewers re-review against the new head.

Testing

• Workflow YAML validated with PyYAML.
• jq filters validated against synthetic review data: one fresh approval -> 1, two stale change requests + one null-commit review -> 0.

Follow-up

Consumers that pin this reusable workflow by SHA (e.g. hyperlight-dev/hyperlight#1568) must bump their pin to the merge commit once this lands.