refactor(agents): port exact-head approval selection to Go #761

Part of #588.

Problem

ma_approved in packages/agents/source/skills/merge-pr/shared/scripts/merge-agent.sh decides whether the required reviewer approved the exact head. It is a pure predicate that guards unattended merges, and it lives in a 235-line shell file. This also covers the approval-selection work in #590.

Scope

Port the approval selection to Go as a pure function over the review list. Keep the exact-head match, the reviewer type check and the rule that a later withdrawal or a stale head voids an approval. Probe for the subcommand first. An older binary uses the frozen shell function, and a supported command that fails refuses without falling back.

Acceptance criteria

• A later CHANGES_REQUESTED or dismissal, an approval on another head, and a reviewer of the wrong type are each rejected.
• The approval cases in tests/skills/agent-merge-pr/policy.bats and workflow.bats pass against the Go path.
• Generated skill output is regenerated in the same PR.

Size and dependencies

S: one pure predicate. Blocked by the replacement-protection issue (#753). Touches a gate path.

Verification

Write the withdrawal and stale-head cases first and watch them fail, then port the Bats approval cases.