Updates dependency policy from 'stdlib only' to 'stdlib preferred,
approved packages allowed'. Adds initial approved list:
- gopkg.in/yaml.v3: YAML parsing for persona files
- github.com/google/go-cmp: Test comparisons with readable diffs
Includes process for adding new dependencies.
When a new push arrives while review-bot is processing, the review
would be posted against a stale commit. This causes noise in the
PR timeline with findings that reference code that no longer exists.
Before posting, re-fetch PR metadata and compare HEAD SHA with the
commit we evaluated against. If they differ, log a warning and exit
successfully — a new workflow run should already be processing the
new HEAD.
Fixes#52
Rodin
