fix(pr-merge): take a cost decision's decided head from the review lane's check-run annotation, not a bot comment #9635

Problem

The cost-decision readers take the decided head from the sha= in the newest unedited github-actions[bot] claude-lane-hold ... criteria=cost marker comment. That holds for the merge-side readers once #9569 merges, and for ci-workflows apply-review-hold/hold.cjs carryDecision. Any workflow running on GITHUB_TOKEN posts as github-actions[bot]. Someone with push access and the workflows permission could therefore run a workflow that posts a marker naming a commit they have not pushed yet, then push that commit, and the same-head shortcut would carry an earlier cost decision onto it with no compare.

This widens nothing today. The same permission can already edit .github/workflows/pr-require-checks.yml directly, and the lanes App has no workflows permission. It is hardening, so that the carry does not rest on a comment author login.

Fix

Take the decided head from the review lane's own check-run annotation, the one ci-status already vets against a head that does not change the lane workflows (pr-require-checks.yml, the review-lane notice loop, ~3755-3776), and stop reading a github-actions[bot] comment for it. Do it in all three merge-side readers (babysit_merge_policy.cost_decision, merge-holds.mjs costDecision, the ci-status lift) and in ci-workflows hold.cjs, so the readers stay in agreement.

Refs

• fix(pr-merge): bind a cost decision to the pull request it names #9569: the readers this changes, where P3 was found in the ready-gate security review.
• Owner decisions Q17 (c) and Q18 (d): fix(pr-pipeline): carry an owner-lifted claude-review cost hold forward across base-only merges #9436 (comment) and fix(pr-pipeline): carry an owner-lifted claude-review cost hold forward across base-only merges #9436 (comment)
• ci-workflows hold.cjs carryDecision (~236-262).

Refs: #9436