ARM API Reviewer agent: pin a session SHA for the entire Reviewer/Critic loop and invalidate on drift

### Background Prior to [PR #43494](https://github.com/Azure/azure-rest-api-specs/pull/43494), the Reviewer agent fetched PR files by branch name or via a freshly-resolved `head.sha` on each tool call. If the PR author pushed a new commit mid-review, the Reviewer could end up: - Drafting findings against commit A but posting them against commit B (line numbers shift, citations become wrong). - Re-invoking the Critic against a different tree than the one the Reviewer judged, producing meaningless disagreements. - Auto-resolving reconciliation threads based on fix-verification anchors that no longer exist. The single-agent loop had no mechanism to detect this; the multi-agent loop made the failure mode much more expensive because the Critic's whole value depends on judging the same tree the Reviewer judged. ### Proposal Capture the PR's current `head.sha` and base SHA/ref as the very first action in Step 1, and make them **binding** for the entire review session: - Every PR-head file fetch (Reviewer and Critic, every iteration) pins to the session SHA. Never to a branch name, never to `HEAD`, never to a freshly re-resolved `head.sha`. - Previous-version fetches pin to the recorded base SHA/ref. - The session SHA is passed verbatim to the Critic on every dispatch (Input #2) and stamped into each posted comment's `head-sha` telemetry field. - Before any mutating action and before every Critic re-invocation, re-confirm the PR's current `head.sha` still equals the session SHA. - If the SHA has moved, the Critic returns `Finding accuracy = INVALIDATED` (reason `session-sha-moved` or `session-sha-unreachable`), which overrides every other track and kills the session. The Reviewer's only legal next actions are restart from Step 1 with a fresh session or abandon. Folding "corrections" into a report drafted against a stale SHA is forbidden. ### References - [`arm-api-reviewer.agent.md`, Step 1: pin the session SHA and base source](https://github.com/Azure/azure-rest-api-specs/blob/raeda/critic/.github/agents/arm-api-reviewer.agent.md#step-1-identify-changed-files-and-choose-review-depth) - [`arm-api-reviewer.agent.md`, Step 7 item 11: session invalidation](https://github.com/Azure/azure-rest-api-specs/blob/raeda/critic/.github/agents/arm-api-reviewer.agent.md#step-7-mandatory-critic-review--gate--no-findings-leave-this-step-unverified) ### Acceptance criteria - The session SHA appears in chat immediately after Step 1 captures it. - An eval covers the SHA-drift case and asserts the Reviewer emits the `SESSION INVALIDATED` template (no findings rendered). - Every posted comment's `head-sha` telemetry field is the full 40-character session SHA.