fix: address review NITs — readability, test dedup, consistent SHA var

- vcs/types.go: restore blank line between CommitID and Comments fields
  for visual grouping (scalar vs slice fields)
- gitea/adapter_test.go: merge duplicate TestAdapter_PostReview_CommitID
  tests into one (Threading was a superset)
- cmd/review-bot/main.go: use evaluatedSHA instead of pr.Head.SHA for
  inline comment CommitID for consistency with review-level usage

cmd/review-bot/main.go

@@ -439,7 +439,7 @@ func main() {
 		inlineComments = append(inlineComments, vcs.ReviewComment{
 			Path:     f.File,
 			Position: pos,
-			CommitID: pr.Head.SHA,
+			CommitID: evaluatedSHA,
 			Body:     fmt.Sprintf("**[%s]** %s", f.Severity, f.Finding),
 		})
 	}

gitea/adapter_test.go

@@ -214,40 +214,6 @@ func TestAdapter_PostReview_EventTranslation(t *testing.T) {
 	}
 }
 
-func TestAdapter_PostReview_CommitID(t *testing.T) {
-	var gotCommitID string
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		var payload struct {
-			CommitID string `json:"commit_id"`
-		}
-		json.NewDecoder(r.Body).Decode(&payload)
-		gotCommitID = payload.CommitID
-		json.NewEncoder(w).Encode(map[string]any{
-			"id":        1,
-			"body":      "test",
-			"user":      map[string]any{"login": "bot"},
-			"commit_id": payload.CommitID,
-		})
-	}))
-	defer server.Close()
-
-	client := gitea.NewClient(server.URL, "token")
-	adapter := gitea.NewAdapter(client)
-
-	_, err := adapter.PostReview(context.Background(), "owner", "repo", 1, vcs.ReviewRequest{
-		Body:     "test",
-		Event:    vcs.ReviewEventApprove,
-		CommitID: "sha256abc",
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if gotCommitID != "sha256abc" {
-		t.Errorf("expected commit_id %q forwarded to client, got %q", "sha256abc", gotCommitID)
-	}
-}
-
 func TestAdapter_PostReview_WithComments_PositionTranslation(t *testing.T) {
 	diff := `diff --git a/main.go b/main.go
 --- a/main.go
@@ -443,7 +409,7 @@ func TestAdapter_RequestReviewerSelf(t *testing.T) {
 	}
 }
 
-func TestAdapter_PostReview_CommitID_Threading(t *testing.T) {
+func TestAdapter_PostReview_CommitID(t *testing.T) {
 	var gotPayload struct {
 		Body     string `json:"body"`
 		Event    string `json:"event"`

vcs/types.go

@@ -98,5 +98,6 @@ type ReviewRequest struct {
 	// If empty, the platform defaults to the current PR head.
 	// Adapters use this as the primary commit anchor for the review submission.
 	CommitID string `json:"commit_id,omitempty"`
+
 	Comments []ReviewComment `json:"comments,omitempty"`
 }