feat(review-pr): add abuse safeguards for review requests

[Sayt-0]

Summary

Adds safeguards against abuse of review requests on every trigger path
(review_requested, /review, @docker-agent mention, automatic opened/synchronize,
and the workflow_run fork path).

Requirement	Status	How
Review requests come from org members	done	PR author verified on the direct pull_request path (was an empty comment author); resolveUsername with a live PR-author fallback; fails closed. review_requested relies on GitHub-native reviewer-request enforcement, now documented.
Log all review requests	done	src/audit-log writes one structured record per request (requester, time, trigger, PR, reviewed SHA, decision) as a notice, a job-summary line, and a 90 day JSONL artifact, on allow and deny paths.
Detect rate anomalies	done	src/rate-limit skips the review above a per-PR frequency threshold; per-PR concurrency: groups collapse same-trigger bursts; existing cache lock prevents concurrent reviews.
Handle force-pushed commits after review	done	src/check-staleness compares the requested SHA to current head, records the reviewed SHA, and posts a notice on rebase.

Validation

Check	Result
build (tsup)	pass
typecheck (tsc)	pass
biome ci	pass (88 files)
actionlint 1.7.12	pass
unit tests	500 pass (30 new)

An adversarial review pass found and fixed two defects: a throttled request could
create a green "PR Review" check (rate check now precedes and gates check
creation), and an audit record could be lost on a setup-credentials failure (an
inline fallback now records it).

Residual design notes

• The rate-limit signal counts the bot's own recent review/reply comments, so it
  catches sustained driving rather than the very first instantaneous burst; that
  first burst is bounded by the concurrency groups and the 600s cache lock.
• The review_requested path verifies the PR author and relies on GitHub-native
  enforcement (only triage/write can request a reviewer) for the requester.
• Not yet exercised by a live end-to-end run; the e2e workflows run on this PR.

Files

New modules: src/audit-log, src/rate-limit, src/check-staleness (each with tests).
Changed: src/check-org-membership, src/post-mention-reply, tsup.config.ts,
.github/workflows/review-pr.yml, .github/workflows/self-review-pr-trigger.yml,
SECURITY.md, review-pr/README.md.

[docker-agent]

Assessment: 🟢 APPROVE

The PR introduces three new modules (src/audit-log, src/rate-limit, src/check-staleness) and wires them into the review workflow with a clear security-first design. The changes are well-structured and the logic holds up under scrutiny.

What was reviewed:

• src/audit-log/index.ts — JSONL artifact, job summary, audit record emission: no data-loss paths in the CLI call chain
• src/rate-limit/index.ts — comment counting with since/updated_at vs. created_at: the explicit client-side created_at filter correctly compensates for GitHub's updated_at-based since parameter; no under-count scenario is possible since updated_at ≥ created_at always holds on GitHub
• src/check-staleness/index.ts — SHA comparison and stale-post logic: correct
• src/check-org-membership/index.ts — resolveUsername fallback on non-event paths: the PR-author fallback on trigger/input paths is intentional design; both paths are gated by trusted callers who control the PR number, so there is no bypass
• .github/workflows/review-pr.yml — rate check ordering, concurrency groups, needs: dependencies: correctly ordered; rate check precedes check creation as documented
• The fail-open behavior for the rate-limit step and the audit decision logging are consistent with the documented design

No confirmed or likely bugs were found in the changed code.