feat: copilot-response accepts a dispatched PR and review

[george-elphick-talieisin]

Summary

• The AI-upgrade caller subscribes to pull_request_review, and GitHub holds the run for approval every time Copilot reviews a PR. So every PR Copilot reviews gets a held run with no jobs, including ordinary PRs where the gate would only skip it. The held runs stay on the head until merge, and have been seen alongside PRs reading UNSTABLE with every required check green (estimist PR 20), though it isn't proven they cause it.
• Option C, agreed with automation-main: the org dispatcher starts the response round via workflow_dispatch, and the v6 caller template drops the pull_request_review trigger. This PR is the reusable workflow's half. It adds pr-number and review-id inputs. When both are empty, the workflow uses the review event, so v5 callers keep working and this merges first.
• The gate now treats the PR number and review ID as identifiers only, in both modes. It reads the PR and the review from the API, which returns 404 for a review from another PR. It also skips two cases:
  • Stale: the review's commit_id is no longer the head. With the dispatcher running hours late, findings could otherwise land on moved lines.
  • Already answered: push-response writes review=<id> into the ai-meta marker on every comment it posts, and the gate skips when one exists. Only comments from talieisin-org-automation[bot] count, so a pasted marker can't block a round.

Rollout

1. This PR merges. It's backward compatible.
2. automation-main lands the dispatcher's "Dispatch Copilot responses" step together with caller template v6 (BOOTSTRAP_VERSION 6).
3. The bootstrap sweep opens a v6 update PR in each repo. The dispatcher dispatches only to repos that have merged theirs, and v5 repos stay on the release pass. Once every repo is on v6, the release pass and the held-review prune are removed.

Test plan

• actionlint: only style notes (SC2129/SC2016) that the file already had
• Gate script extracted and run against a mocked gh in 13 cases:
  • dispatch mode and event mode both proceed, with correct outputs (pr-number, review-id, head-sha, head-ref, base-ref)
  • skip: bad input, only one input, stale review, already answered, human PR, non-Copilot review, not ai-complete, no inline comments
  • an answered review=990 doesn't block review=99, and a marker posted by someone else is ignored
  • a failed read of the PR's comments fails the job instead of counting as unanswered
• Event mode on the first released Copilot run on an ai-complete PR after merge (v5 path unchanged)
• Dispatch mode on the first v6 repo once automation-main's side lands

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Copilot]

Copilot review overview

🟡 Changes recommended

The answered-review marker must be made reliable to prevent duplicate responses.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Best-effort marker write allows duplicate review processing · New

What changed in this PR

Updates the reusable Copilot response workflow for dispatcher-triggered reviews while preserving event-based compatibility.

Changes:

• Adds PR/review inputs and API-backed validation.
• Skips stale or already-answered reviews.
• Propagates validated metadata through response and push jobs.

File	Summary
.github/​workflows/​copilot-response.yml	Adds dispatch handling, validation, deduplication, and metadata propagation. The answered marker is not reliably recorded after partial failures.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Partial reply failures can incorrectly mark reviews as answered and prevent retries.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Best-effort marker write allows duplicate review processing