slash-commands: fall back to direct merge when bot approval fails code-owner check

When branch protection enables require_code_owner_review, the GitHub
App's APPROVE review does not satisfy it (Apps cannot be team members).
Auto-merge also does not inherit the App's ruleset-bypass privileges,
so the PR sits in BLOCKED/REVIEW_REQUIRED forever with auto-merge
enabled but never firing.

Detect this by reading reviewDecision back from the
enablePullRequestAutoMerge mutation. If it is still REVIEW_REQUIRED
after we submitted an approval, attempt a direct merge instead — a
direct merge does use the App's bypass.

Both direct-merge paths (this new one and the existing clean-status
fallback) now go through a shared mergeDirect helper that catches
failures and emits an actionable warning pointing at the ruleset
bypass-list setup.

🏠 Remote-Dev: homespace

slash-commands/README.md

@@ -45,6 +45,16 @@ review; `/lgtm` satisfies that via the App's approval and turns on auto-merge.
 The PR merges as soon as CI passes. Manually adding the `accepted` label in
 the GitHub UI has no effect — the gate is the review, not the label.
 
+> [!IMPORTANT]
+> If your branch protection enables **Require review from Code Owners**, the
+> App's approval will _not_ satisfy it — GitHub Apps cannot be members of org
+> teams, so they cannot be code owners via a team entry. Auto-merge also does
+> not inherit the bypass privileges of the App that enabled it. To make
+> `/lgtm` work under this rule, **add the GitHub App to the ruleset's bypass
+> list** (Settings → Rules → Rulesets → _your ruleset_ → Bypass list → add
+> the App with mode _Always_). The action detects this case and falls back to
+> a direct merge, which _does_ use the App's bypass.
+
 ## Prerequisites
 
 - **A GitHub App** installed on the caller repo with the permissions listed