- approval gate now honors latest review state per reviewer; a reviewer
who later submits CHANGES_REQUESTED or has their approval dismissed no
longer counts as approved. Plain COMMENTED follow-ups don't override
an existing approval (matches GitHub's own behavior).
- success summary links to the tag's tree URL instead of /releases/tag/,
which would 404 because this workflow creates an annotated git tag,
not a GitHub Release object.
b7a09856e0