fix: gate release branch PRs with team review, scope fallback to non-release

[Qbandev]

Summary

Replaces the blanket "no approval necessary" fallback (from PR #83) with two scoped rules so that PRs targeting release/* branches are properly gated.

Rules

Rule	Scope	Requires	Purpose
cherry-pick auto-approval	release/* + cherry-pick title + < 200 LOC	count: 0	Auto-approve qualifying cherry-picks
release branch review	release/* (any PR)	1 approval from MetaMask/release-team	Gate all other release PRs
non-release fallback	Everything except release/*	count: 0	Clean approved status for non-release PRs

The fallback uses a RE2-compatible negation regex since Go's regexp engine does not support lookaheads:

^([^r]|r[^e]|re[^l]|rel[^e]|rele[^a]|relea[^s]|releas[^e]|release[^/]).*$|^.{0,7}$

Evaluation scenarios

#	Scenario	Rule 1	Rule 2	Rule 3	or result
1	Cherry-pick PR → release/* (< 200 LOC)	✅ approved	⏳ pending	skipped	SUCCESS
2	Regular PR → main	skipped	skipped	✅ approved	SUCCESS
3	Wrong title (no cherry-pick) → release/*	skipped	⏳ pending	skipped	PENDING
4	Large PR (> 200 LOC) → release/*	skipped	⏳ pending	skipped	PENDING

Test plan

• Scenario 1: Cherry-pick PR targeting release/* with correct title and < 200 LOC → success
• Scenario 2: Regular PR targeting main → success (fallback rule)
• Scenario 3: PR targeting release/* without "cherry-pick" in title → pending
• Scenario 4: Large cherry-pick PR (> 200 LOC) targeting release/* → pending

🤖 Generated with Claude Code