fix: keep review requests read-only

[giscebot]

Summary

• force every submit_review job to use review_only after classification
• prevent later intent updates from elevating review jobs to work_allowed
• cover the real fix(deps): ... title regression and post-enqueue reclassification

Validation

• pytest -q tests/test_webhook.py::test_webhook_canary_enqueues_pull_request_review_requested_for_configured_bot tests/test_queue.py::test_submit_review_intent_cannot_be_elevated_after_enqueue

TASK-85718

Requested by: @ecarreras

[giscebot]

Post-merge verification completed on current origin/main at bda03c4 (which contains merge commit 52ca9ac):

• regression tests for webhook review-request ingestion and post-enqueue intent elevation: 2 passed
• full test suite: 439 passed

No follow-up patch is needed. The submit_review read-only guardrail is integrated and the review-request item is resolved by the merge.