[pournasserian]

Closes #2578

What

The third slice of F-DSK (#2422): the review actions on the set view (DSK-03). A reviewer can approve, reject with a reason (CHG-08), publish an approved set and revert a published one (CHG-06). Each action is saved when it is made.

• Review panel on /sets/{id}, offering only what the state allows:
  • Awaiting review: Approve and Reject.
  • Checks failed: Reject.
  • Approved: Publish.
  • Published: Revert.
  • Any other state: no action, and the panel says why.
• Reject opens the existing Dialog with a required reason. The directory refuses a blank one, and the stored reason shows on the view.
• Revert is one click (S3). It opens the set that undoes this one, with the rationale "Revert change set {id}: {rationale}", and redirects to it. The new set is reviewed like any other.
• Each action is a posted form with an anti-forgery token on the static page. It calls TransitionAsync, RejectAsync, PublishAsync or RevertAsync on IChangeSetDirectory, which appends the event with the signed-in person as initiator. Then the page shows the set as it is now, with a status line or the refusal.
• Moved-on guard: every form carries Seen, the id of the last move event of the set the page showed. If the set has moved since, the action is refused with "The set has moved on since this page was shown." Every action's form is always on the page, hidden when not offered, so a post from an older page reaches its handler and gets that message instead of a 400.

Why

• Forms on the static page, not circuit handlers. ADR-0006 asks that review decisions survive a lost circuit. A posted form needs no circuit, and the request carries the signed-in person, so ICurrentInitiator needs no circuit-side variant.
• The moved-on guard. Without it, a page left open could approve a set that was reopened, changed and resubmitted in the meantime. The last move event is already read for the page's times, so the guard costs no query.
• Approve moves the set to approved. Approvals per reviewer and N approvals (RTE-05) are F-RTE's next slice. Approve then records an approval instead.
• Not in this PR: edit in place (CHG-07, needs F-FRM), the sample selector (RTE-04), "propose a rule" after a rejection or revert (RUL-08, needs F-RUL), and keyboard shortcuts (next slice).

Tests

• bUnit ChangeSetViewTests:
  • For each of the eight states, the panel offers exactly the allowed actions and explains itself. All four forms are on the page, the ones not offered are hidden, and each Seen is the last move's id.
  • The reject dialog has a required reason.
• Integration, host:
  • A reviewer approves and then publishes a set. Each page shows the new state and the next action. Both events name the reviewer, and the set moves to recently published.
  • A blank reason is refused and leaves the set awaiting review. A real reason rejects the set and shows on the view, and no action is left.
  • Revert redirects to a new open set that reverts the original and links to it.
  • A post with the Seen of a page shown before another reviewer approved the set is refused, and nothing is appended.
  • An anonymous post goes to sign-in, and a post without the anti-forgery token answers 400 and changes nothing.
  • Awaiting review offers approve and reject, checks failed offers reject, and checks running offers nothing.

dotnet build -warnaserror and the full suite pass locally against a postgres:17 container as well as SQLite. No new package and no new project reference.

Checklist

• Linked to an issue a maintainer has confirmed
• Targets v2
• Tests or docs updated where behaviour changed
• No tool-generated co-author trailers or footers