chore: review workflow supports merge conflicts — Phase A0 before CI failures

[mhenrixon]

Summary

Adds a Phase A0: Merge conflicts step to the full review pass — it runs BEFORE the CI-failures phase so CI is diagnosed against the post-merge reality, not a base that no longer exists.

• /github-review-pr:
  • Phase A0 detection: gh pr view --json mergeable,mergeStateStatus,baseRefName, with a local git merge-tree --write-tree --name-only fallback when GitHub reports UNKNOWN — tested against the PR's ACTUAL head (git fetch origin pull/<PR>/head + FETCH_HEAD, never the local HEAD), with git rev-parse --verify on both refs before trusting merge-tree's exit code; the --name-only output is the resolution work list.
  • Resolution runbook: gh pr checkout on a clean tree, merge never rebase (shared branch — no force-push), semantic per-file resolution rules, verification gates before pushing, plain git push.
  • Loop-back rules (new conflict mid-pass → back to A0; new CI failure in Phase B → back to A), a mergeability re-check before the final report, and Phase A0 + end-state sections in the Phase C report.
• /github-review-failures: a detection-only pre-flight — CONFLICTING stops and hands off to /github-review-pr's Phase A0 (this command's toolset deliberately excludes the merge machinery); UNKNOWN proceeds.
• allowed-tools frontmatter now covers every command the text instructs (gh pr checkout, git status/switch/fetch/merge/merge-tree/rev-parse, bundle install, bun install, cd).

Repo-specific adaptations (verified against this repo, not copied from phlex-reactive)

• lib/phlex_forms/version.rb: the "a version conflict means the branch bumped on purpose" rule holds here — rake release[X.Y.Z] aborts unless on main and commits the bump directly to main, so feature branches never touch this file accidentally.
• docs/Gemfile.lock: the only committed Ruby lockfile (the gem root's is gitignored). Take the base's file (it carries the released phlex-forms pin); if the branch changed docs deps, re-resolve via cd docs && bundle install — with the Rakefile's documented PLATFORMS caveat (a full re-resolve can fail; stop and ask rather than hand-edit).
• docs/bun.lock: take base, re-run cd docs && bun install if the branch changed docs/package.json.
• No generated-artifact rules: docs CSS builds (docs/app/assets/builds/) are gitignored; phlex-reactive's min.js/vendored-twin rules do not apply and were not ported.
• Append-only registries: docs/app/models/doc.rb only (keep both sides' page lines, base order first) — docs/config/routes.rb is static docs-kit boilerplate here (pages are served through the one docs/:doc route), so it isn't a per-page registry in this repo.
• Verification gates are this repo's real CI commands: bundle exec rubocop lib spec (the Lint job's exact invocation) + bundle exec rspec; docs files lint via the docs app's own .rubocop.yml with files passed explicitly.

Backport of zoolutions/phlex-reactive#220.