fix(review): prevent fast-path planned-action ID collisions

[rianjs]

Problem

A live approval-override review failed before posting:

ledger: insert planned action: constraint failed: UNIQUE constraint failed: planned_actions.action_id (1555)

The approval-override and partial-repair fast paths allocate a fresh run, but each inserts a process-wide constant planned-action ID:

• approval-override-submit-review
• repair-submit-review

The ledger defines planned_actions.action_id as a table-wide primary key, so the first persisted action with either constant prevents the same fast path from running again in that ledger.db, even for a different PR and run.

Empirical evidence

This was reproduced and validated without mutating GitHub or local review data:

• A read-only query of the active ledger found approval-override-submit-review already posted for PR fix: make review workbenches location-independent and resume-safe #507 under run 33906726-3fed-45b4-b7a5-e17c6a69d90f on 2026-07-12.
• PRAGMA table_info(planned_actions) confirmed action_id is the table primary key, while run_id is not part of that key.
• PR feat(review): layer repo-local and shared reviewer selection #517's valid author override request was classified approve=true, then insertion failed with the unique constraint.
• The ledger contained no new PR feat(review): layer repo-local and shared reviewer selection #517 run after the override request timestamp, matching the application's cleanup of the freshly allocated run after the failed action insertion.
• Focused regression tests seeded legacy rows using each constant ID. Before the fix, both the approval-override and repair tests failed with the same SQLite constraint error.

Expected behavior

Every planned action must have a globally unique ID. A prior approval override or repair action must not block a later fast-path execution.

Acceptance criteria

• Approval-override planned-action IDs are scoped by their owning run.
• Partial-repair planned-action IDs are scoped by their owning run.
• Existing legacy constant-ID rows remain valid; no ledger migration or purge is required.
• Posted action markers use valid marker-safe IDs.
• Regression tests cover collisions with pre-existing legacy rows for both paths.
• The full test suite passes.

[rianjs]

Converged implementation plan

The independent GPT-5.6 Sol architect review converged with no blockers or majors.

• Scope the approval-override and partial-repair planned-action IDs by their owning run.
• Keep the ledger's global action_id uniqueness constraint unchanged.
• Extend the existing integration tests by seeding completed legacy runs with the old constant IDs.
• Assert new persisted actions and posted markers use marker-safe run-scoped IDs.
• Re-read the seeded legacy actions after execution and assert they remain unchanged.
• Require focused package tests and the full Go suite to pass.

Compatibility: no public API, schema, dependency, migration, purge, or CLI flag changes.