fix preserve Dependabot reviewer intent

[Pigbibi]

What changed

• model both review_requested and review_request_removed timeline events
• paginate the complete PR timeline
• re-check current reviewer state immediately before deletion
• preserve the latest human request/removal intent during concurrent updates
• restore a human request only when it is still the latest human action and currently absent
• handle concurrent DELETE races without hiding genuine API failures

Why

This closes the remaining reviewer-state races in Dependabot CODEOWNERS cleanup. A maintainer can request or withdraw review while cleanup is queued without having that intent overwritten.

Validation

• bash syntax check
• jq event-state fixture check
• git diff --check
• no checkout or execution of PR code

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in .github/workflows/dependabot_review_request_cleanup.yml

The concurrent-intent scan treats every actor except dependabot[bot], app/dependabot, github-actions[bot], and github-actions as a human. In GitHub timelines, other automation identities such as GitHub Apps and bot accounts have different actor.login values, so a concurrent request/removal from another bot is incorrectly treated as human intent. Reachability is direct from the PR timeline API used here: if another app requests Pigbibi while this workflow runs, human_intent becomes review_requested and the workflow will preserve or restore that bot-driven request as though a maintainer made it, producing the wrong final reviewer state. (line 73)

Suggestion: Classify humans by actor type instead of a small denylist of bot logins, for example by requiring .actor.type == "User" (and excluding bot/app actor types) when deriving human_intent.

---

Review by Codex PR Review bot • PR