fix(ci): retire superseded Ladon change requests

[bokelley]

Summary

• retire an older Ladon CHANGES_REQUESTED review only after Ladon approves the current PR head
• leave human reviews, other reviewers, current change requests, comments, and stale-head approvals untouched
• unit-test the review-selection and dismissal API behavior in the workflow-security job
• treat the trusted helper as part of the human-gated review workflow

Why

PR #1134 had every required CI check green and a Ladon approval on its final head, but GitHub kept Ladon’s earlier CHANGES_REQUESTED review active. That left the PR blocked until an admin merge. GitHub only auto-dismisses stale approvals; it does not retire an earlier change request when the same App later approves.

Verification

• node --test scripts/retire-superseded-ladon-reviews.test.cjs
• node --check scripts/retire-superseded-ladon-reviews.cjs
• actionlint 1.7.7 on ai-review.yml and ci.yml
• read-only replay against PR fix(codegen): restore downstream model contracts #1134 selected only review 5123075139, the superseded Ladon change request

Security

The helper runs from the trusted base-SHA checkout under pull_request_target, uses the existing short-lived Secretariat App token, and can only dismiss older change requests authored by that same App after its latest review approves the exact current head SHA.

[aao-secretariat]

Ladon is not auto-reviewing this PR because it modifies the review system itself (.github/workflows/ai-review.yml). A human reviewer should review and merge this PR; Ladon resumes on subsequent PRs once these changes land on main.