fix preserve Dependabot reviewer intent

[Pigbibi]

What changed

• model both review_requested and review_request_removed timeline events
• paginate the complete PR timeline
• re-check current reviewer state immediately before deletion
• preserve the latest human request/removal intent during concurrent updates
• restore a human request only when it is still the latest human action and currently absent
• handle concurrent DELETE races without hiding genuine API failures

Why

This closes the remaining reviewer-state races in Dependabot CODEOWNERS cleanup. A maintainer can request or withdraw review while cleanup is queued without having that intent overwritten.

Validation

• bash syntax check
• jq event-state fixture check
• git diff --check
• no checkout or execution of PR code

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Reliability in .github/workflows/dependabot_review_request_cleanup.yml

The restore path still has a time-of-check/time-of-use race. human_intent is computed once from events_after, then the job only checks whether the reviewer is currently absent before POSTing a new review request. If a maintainer withdraws the review again after events_after is fetched but before the POST runs, the workflow will restore the reviewer from stale state and overwrite the latest human removal intent. (line 77)

Suggestion: Immediately before the restore POST, re-read the latest relevant timeline event (or otherwise perform another fresh compare-and-check) and only restore when review_requested is still the latest non-bot action for that reviewer.

---

Review by Codex PR Review bot • PR