feat: resolve the reviewer identity from protected variables
PR governance action v2: review required at R0, fail-closed policy, s… …plit label recording, merge-aware secret scan