fix: rerun failed synchronize oracle suite after verdict lands

[joeharris76]

When the oracle verdict is posted after the pull_request synchronize oracle-review suite already failed waiting for it, the required check stays red and the pull request stays blocked. Grant the verdict post job actions write and rerun the failed synchronize suite runs for the reviewed head once the verdict is posted. Proven against live data: the new filter selects exactly the stale run. Workflow tests cover the trigger and permission shape.

[joeharris76]

Stand-in oracle review: APPROVE 9ded4fb

[benchbox-oracle]

oracle-verdict: success for 9ded4fb7e19ca38db647970f74292a3b5d270a30

This result supersedes those for earlier heads; their open review threads still apply.

Tier: very-high (changes the gate: .github/workflows/oracle-verdict.yml).

Decision: SHIP.

Reviewer: opus (claude claude-opus-5-5, effort medium).

The change adds actions: write to the oracle-verdict post job. It also adds a final step that uses GITHUB_TOKEN to rerun failed oracle-review runs (pull_request event) for the planned head SHA.

This does not weaken the merge gate. oracle-review checks out the trusted base and runs oracle_review_check.py, which fetches the live head SHA, reviews and threads from the API. A rerun therefore checks the gate again against current state, and it can only pass if a qualifying oracle review now exists for the current head.

The step runs only after finalize and the guard step succeed (the implicit success() applies) and only when the App is configured.

The new actions: write scope is less powerful than what the job already holds: it already mints an App token with statuses:write and pull-requests:write. Adding actions:write adds no meaningful attack surface for untrusted attempt artifacts.

Remaining weaknesses all fail closed, so the check stays red and no verdict is wrong. They are:

• The step reruns even when the guard skipped posting or the verdict was not a pass.
• It lists only the latest 100 runs instead of filtering by --commit, so the failed run may not be found.
• A rerun of a stale head's run can cancel a newer in-progress oracle-review run, because that workflow's concurrency group has cancel-in-progress set.

The tests were updated consistently with the new permission and step.