An untrusted edit after ready-for-agent makes an issue not Ready #668

This was generated by AI during triage.

Private record: https://github.com/JacobStephens2/thirdshift/security/advisories/GHSA-r956-rx3x-4cpj

What to change

An issue's title or body, edited by an account that isn't a Trusted account after ready-for-agent was last applied, stops it being a Ready issue. The Trusted account rule is the one from the blocking issue. The issue is passed over, with a line saying it was edited after it was marked ready, until a Trusted account labels it again. Edits by Trusted accounts don't count. Body edits come from the issue's userContentEdits and title edits from RenamedTitleEvent, both in GraphQL.

A Spec run applies the same check to each Ticket before it starts that Ticket's Run, comparing edits against the last time the Ticket or its Spec was marked ready, whichever is later. Before each later session of a Run (Resume, Repair, review), the issue is checked again. If an untrusted edit has appeared since the Run started, the Run fails instead of starting another session on the edited text.

Acceptance criteria

• A ready-for-agent issue whose body was edited by an untrusted account after the label was applied is passed over, with a line that names why.
• The same applies to a title edit.
• An edit by a Trusted account doesn't change whether the issue is Ready.
• A Trusted account applying ready-for-agent again makes the issue Ready again, once it has settled.
• A Spec run doesn't start a Ticket that has an untrusted edit made after it was marked ready.
• A Run whose issue gets an untrusted edit while it is under way starts no further session.

Out of scope

• Comments (separate issue).