fix(pr-pipeline): start the address-feedback and review-dependency subscription legs from trusted values #9365

Problem

In .github/workflows/pr-unblock.yml, the address-feedback-subscription and review-dependency-subscription legs start on the read runner's run-job outputs: if: needs.<leg>.outputs.lane-class == 'credit-stop' || needs.<leg>.outputs.credential-present == 'false'. Rule h16 holds the read runner's run job hostile, and these values come from it. A forged run job can therefore start or suppress the subscription leg.

#9363 fixes this for fix-ci (#8890). It adds a fix-ci-handoff job that reads this run's jobs through the Actions API and starts the subscription on needs.fix-ci-handoff.outputs.posted != 'true'. It also leaves one residual in fix-ci itself: the subscription's fallback: label (credit-stop or no-key) still reads needs.fix-ci.outputs.lane-class.

Fix

Give address-feedback and review-dependency the same handoff job as fix-ci, and start each subscription leg on its output. Derive the fallback: label from a trusted source too, or drop it if nothing gates on it. Extend the callers.test.mjs pin to assert that no subscription leg's if: reads a run-job output.

Refs: #8890, #9363