review: let CodeRabbit's approval satisfy the one-approval rule on main

[dcotelo]

Problem

main requires one approving review. As the sole maintainer, every pull request
lands with --admin, so the rule is satisfied by bypassing it rather than by
meeting it. CodeRabbit already reviews every pull request and found real defects
on #31, #33 and again on #33's full review, but its verdict cannot satisfy the
rule: it submits COMMENTED reviews, never APPROVED.

Proposed behavior

Set reviews.request_changes_workflow: true in .coderabbit.yaml. CodeRabbit
then approves once its comments are resolved, the latest commit has been
reviewed, and no pre-merge checks are failing — so a clean pull request reaches
mergeStateStatus: CLEAN and merges without --admin.

Alternatives considered

• auto_assign_reviewers: true alone: makes CodeRabbit visible as a reviewer
  without changing what can merge. Cosmetic, keeps --admin.
• Leave it. --admin is at least honest about what is happening: the rule is
  bypassed, not met.

Additional context

Surface: .coderabbit.yaml and the branch protection on main. No code change.

Two risks, both needing verification before this is called done.

1. Whether the approval counts at all. GitHub treats bots inconsistently:
   Actions reviews count subject to an org toggle, while Copilot's reviews
   appear among the approvals but explicitly do not count. CodeRabbit is a
   GitHub App with write access, which ordinarily does count, but given the
   Copilot carve-out this should be proven rather than assumed — flip the
   setting and check mergeStateStatus on the next real pull request.

2. dismiss_stale_reviews: true versus the release bot. release-bump pushes
   chore(release): <version> into the branch after review, which dismisses
   the approval CodeRabbit just gave. It does re-review a new head — observed on
   feat(doctor): report a CLI older than the plugin, and a statusLine that is not ours #33 — but whether it re-approves is unverified. If it does not, the options
   are turning off stale dismissal, which weakens the rule for human reviews
   too, or accepting a second review cycle on every release.

Worth weighing before doing it. The one-approval rule exists so that
something other than the author looks at a change. Today that is satisfied by a
documented exception. This replaces the exception with a bot that can approve
its own clean bill of health, which is a different posture from the one the
shipshape audit accepted. A real trade, not just plumbing.

Current protection on main, for reference: one approving review required,
require_code_owner_reviews: false, dismiss_stale_reviews: true,
enforce_admins: false, required checks lint, test, manifest — note that
bump and CodeRabbit are not required checks.