fix: post new review first, then supersede old with link

Changes the order of operations:
1. POST new review (gets non-stale badge immediately)
2. PATCH old review with superseded message linking to the new one

This gives the superseded comment a clickable link to the current
review, making navigation between review iterations easy.

buildSupersededBody now accepts a newReviewURL parameter.

cmd/review-bot/main_test.go

@@ -60,17 +60,21 @@ func makeReview(id int64, login, state string, stale bool, body string) gitea.Re
 func TestBuildSupersededBody(t *testing.T) {
 	original := "# Review\n\nLooks good.\n\n<!-- review-bot:sonnet -->"
 	sentinel := "<!-- review-bot:sonnet -->"
+	newURL := "https://gitea.example.com/owner/repo/pulls/1#pullrequestreview-99"
 
-	result := buildSupersededBody(original, "abcdef1234567890", sentinel)
+	result := buildSupersededBody(original, "abcdef1234567890", newURL, sentinel)
 
 	// Should contain the struck-through banner
 	if !strings.Contains(result, "~~Original review~~") {
 		t.Error("missing struck-through banner")
 	}
-	// Should contain superseded notice
+	// Should contain superseded notice with link
 	if !strings.Contains(result, "**Superseded**") {
 		t.Error("missing superseded notice")
 	}
+	if !strings.Contains(result, "[see current review]("+newURL+")") {
+		t.Error("missing link to new review")
+	}
 	// Should contain collapsed original
 	if !strings.Contains(result, "<details>") {
 		t.Error("missing details/collapse")
@@ -95,7 +99,7 @@ func TestBuildSupersededBody(t *testing.T) {
 
 func TestBuildSupersededBodyShortSHA(t *testing.T) {
 	// Short SHA should pass through without panic
-	result := buildSupersededBody("body", "abc", "<!-- review-bot:x -->")
+	result := buildSupersededBody("body", "abc", "https://example.com/review", "<!-- review-bot:x -->")
 	if !strings.Contains(result, "abc") {
 		t.Error("short SHA not preserved")
 	}