fix(scripts): read revert subjects and assert the canary's replay attributions

.github/workflows/silent-revert-canary.yml

@@ -12,10 +12,13 @@ name: silent-revert-canary
 #
 # DETECTION, NOT PREVENTION -- and deliberately so.
 #
-#   * It runs on `push` to main only. There is no `pull_request` trigger, so it
-#     can never gate a PR. By the time it speaks, the merge has happened; the
-#     value is that a human learns within minutes instead of during a
-#     from-scratch content audit weeks later.
+#   * Scanning runs on `push` to main only. There IS a `pull_request` trigger
+#     below, but it only exercises the detector against its own tests and its
+#     recorded corpus (see the note above `on:`); the range-resolution and scan
+#     steps are both gated `if: github.event_name != 'pull_request'`, so no PR
+#     is ever inspected for silent reverts. By the time the canary speaks, the
+#     merge has happened; the value is that a human learns within minutes
+#     instead of during a from-scratch content audit weeks later.
 #   * It is NOT in ci.yml and is NOT wired into that workflow's `ci-status`
 #     aggregate, which is the single required check the org ci-gate ruleset
 #     keys on. Adding it there would make a detection heuristic able to block
@@ -35,12 +38,12 @@ name: silent-revert-canary
 # exactly the false-green this lane exists to remove. Pushes to main are
 # infrequent enough that letting every run finish costs nothing worth saving.
 
-# The `pull_request` trigger runs the detector's OWN tests, never the canary.
-# The scan step is gated off for PR events below, so nothing on a PR ever
+# The `pull_request` trigger exercises the detector against its OWN unit tests
+# and its recorded incident corpus, never against the PR. The range-resolution
+# and scan steps are gated off for PR events below, so nothing on a PR ever
 # inspects that PR for silent reverts -- detection stays post-merge, per the
-# design note above. What a PR gets is ordinary unit-test coverage of a shipped
-# script, scoped by `paths` to the canary's own files so it is inert on every
-# other PR.
+# design note above. What a PR gets is ordinary coverage of a shipped script,
+# scoped by `paths` to the canary's own files so it is inert on every other PR.
 #
 # Without it the detector would ship untested until the next push to main, and
 # the specific way this script can break is a false GREEN: if the blame parser