tests: the review loop, driven end to end by three accounts !242

Stacked on !241.

Approvals, CODEOWNERS, review threads and notifications each had a test. Nothing put them together, so the loop a repository actually runs — draft, ready, thread, approval, resolve, merge — had never executed once, with all three settings on at the same time.

Three accounts: an author, an owner named in CODEOWNERS, and a collaborator who owns nothing. The third isolates the CODEOWNERS gate — their approval meets require-approvals and leaves the owner requirement unmet, so the refusal can only be CODEOWNERS.

On #139 specifically. You asked for this instead of the second human, and I want to be exact about what it does and does not do. The CODEOWNERS bug was a gate that never fired; a test written from the same understanding as the code would have asserted the same wrong thing. This closes the narrower gap — that the features had never met — and not the one #139 names.

Writing it found two real things:

• mr ready (from !240) notified a thread's participants, which at that moment is the author alone, who is the actor and excluded. It reached nobody. Corrected here to notify the repository's targets, the way opening one does.
• There is no way to ask a particular person for a review. The queue is computed from involvement; a collaborator with write access who has not touched the thread gets nothing in their inbox for the whole life of the MR. Filed as #145. The test asserts today's behaviour and fails if it changes, so the issue cannot go stale silently.

Closes #139