ci: bind the no-mistakes attestation to the current PR head - #161

$ node --test test/no-mistakes-gate.test.mjs
▶ no-mistakes PR gate
  ✔ accepts a body whose attestation completes review, test, and document
  ✔ still rejects a body with no no-mistakes signature
  ✔ rejects a signed body with no attestation and names the required version
  ✔ rejects an attestation whose test step is skipped
  ✔ rejects an attestation whose test step is failed
  ✔ rejects an attestation whose test step is running
  ✔ rejects an attestation whose test step is pending
  ✔ rejects an attestation that omits a required step entirely
  ✔ rejects a required step recorded twice unless every record completed
  ✔ rejects a completed step carrying a skip_reason marker
  ✔ rejects a completed step carrying a skipped marker
  ✔ rejects a completed step carrying a agent_unavailable marker
  ✔ rejects a completed step carrying a quota_exhausted marker
  ✔ accepts an attestation whose head_sha is the PR's current head
  ✔ rejects an attestation whose head_sha is not the PR's current head
  ✔ fails closed when the attestation carries no head_sha at all
  ✔ fails closed when the PR head sha is unavailable
  ✔ fails closed on an attestation payload that is not valid JSON
  ✔ fails closed when the payload has no steps array
  ✔ fails closed when the attestation comment is never closed
  ✔ accepts a CRLF body
✔ no-mistakes PR gate (361.099541ms)
ℹ tests 21
ℹ suites 1
ℹ pass 21
ℹ fail 0
ℹ skipped 0

$ eslint packages/axi-sdk-js/src packages/axi-sdk-js/test eslint.config.mjs scripts test
(clean)

$ prettier --check ...
Checking formatting...
All matched files use Prettier code style!

$ node scripts/generate-docs.mjs --check
docs:check ok — generated regions match their sources