[Fix] Review notifications omit resolve actions for open feedback

[roomote-roomote]

Opened on behalf of Daniel Riccio. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

Related issue

Internal maintainer request; no linked issue.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

Actionable pull-request notifications could render as informational messages without resolve actions when triage returned incomplete or contradictory output, even though live PR state still had unresolved feedback, failing CI, or merge conflicts.

What changed

• Build one deterministic, PR-specific resolve action from unresolved review threads, failed or errored CI checks, and merge conflicts.
• Combine every live actionable signal in the follow-up and override incomplete or contradictory triage output.
• Keep notifications informational when no actionable live state remains.
• Cover empty, partial, rejected, individual-signal, and mixed-signal triage responses.

How it was tested

• Targeted SDK notification-delivery tests pass with 33 cases.
• SDK type checking, formatting, and targeted lint checks pass.
• Repository pre-push checks pass.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

[roomote-community]

1 issue outstanding. See task

• packages/sdk/src/server/lib/task-runs/pr-review-notification-delivery.ts:810 Avoid inserting untrusted CI check names into dispatched agent prompts.

_{Reviewed 53fe8f3}

[roomote-community]

CI check names are untrusted PR-controlled data (a pull_request workflow can assign a job an instruction-looking name), but this fallback interpolates them verbatim into followUpPrompt. That prompt is auto-dispatched directly to the agent when auto-handle is enabled, so a malicious check name can become an agent instruction without user interaction. Preserve the label as quoted data or sanitize it before building the executable follow-up prompt.