fix(pr-merge): bind a cost decision to the pull request head it approves #9493

Problem

A **Decision recorded.** Cost: comment clears the cost hold on a lanes App PR, but nothing binds it to that PR's head or to the cost change it approves. Both readers check only author, App, edit and time; for a comment on the closing issue the only binding is that it is newer than the PR's createdAt. The lanes App controls closingIssuesReferences through its own PR body.

Readers with the gap:

• .github/scripts/pr-merge/merge-holds.mjs (costDecision, added by fix(pr-pipeline): hold native lane PRs on marketplace and cost paths #9488)
• plugins/source-control/skills/babysit-prs/scripts/babysit_merge_policy.py (cost_decision)

Found by the security lane on #9488: #9488 (comment)

Exploit path

1. A lanes App PR is opened.
2. The owner posts an unedited cost decision on issue K for a different change, after that PR was created.
3. The PR (push or body edit) changes a cost path and sets Closes #K.
4. ci-status and enable-auto-merge read the comment as the owner's decision for this change.

Done when

Both readers accept a cost decision only when it is bound to the PR's current head (comment newer than the last push, or names the head SHA), or, for a closing-issue comment, only when the issue was linked before the comment was posted; the JS/Python parity test covers the rule.

Owner decision Q10 (2026-10-23): fix separately; #9488 merges as-is.