fix: address review NITs — readability, test dedup, consistent SHA var

- vcs/types.go: restore blank line between CommitID and Comments fields
  for visual grouping (scalar vs slice fields)
- gitea/adapter_test.go: merge duplicate TestAdapter_PostReview_CommitID
  tests into one (Threading was a superset)
- cmd/review-bot/main.go: use evaluatedSHA instead of pr.Head.SHA for
  inline comment CommitID for consistency with review-level usage

cmd/review-bot/main.go

@@ -439,7 +439,7 @@ func main() {
 		inlineComments = append(inlineComments, vcs.ReviewComment{
 			Path:     f.File,
 			Position: pos,
-			CommitID: pr.Head.SHA,
+			CommitID: evaluatedSHA,
 			Body:     fmt.Sprintf("**[%s]** %s", f.Severity, f.Finding),
 		})
 	}
@@ -485,7 +485,7 @@ func main() {
 	reviewReq := vcs.ReviewRequest{
 		Body:     reviewBody,
 		Event:    event,
-		CommitID: pr.Head.SHA,
+		CommitID: evaluatedSHA,
 		Comments: inlineComments,
 	}
 	posted, err := client.PostReview(ctx, owner, repoName, prNumber, reviewReq)

gitea/adapter_test.go

@@ -409,7 +409,7 @@ func TestAdapter_RequestReviewerSelf(t *testing.T) {
 	}
 }
 
-func TestAdapter_PostReview_CommitID_Threading(t *testing.T) {
+func TestAdapter_PostReview_CommitID(t *testing.T) {
 	var gotPayload struct {
 		Body     string `json:"body"`
 		Event    string `json:"event"`

gitea/client_test.go

@@ -147,6 +147,46 @@ func TestPostReview(t *testing.T) {
 	}
 }
 
+func TestPostReview_CommitID(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != "POST" {
+			t.Fatalf("expected POST, got %s", r.Method)
+		}
+
+		body, _ := io.ReadAll(r.Body)
+		var payload struct {
+			Body     string `json:"body"`
+			Event    string `json:"event"`
+			CommitID string `json:"commit_id"`
+		}
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatalf("unmarshal payload: %v", err)
+		}
+		if payload.CommitID != "deadbeef123" {
+			t.Errorf("expected commit_id %q, got %q", "deadbeef123", payload.CommitID)
+		}
+		if payload.Event != "APPROVED" {
+			t.Errorf("expected event APPROVED, got %q", payload.Event)
+		}
+
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"id":101,"user":{"login":"review-bot"},"state":"APPROVED","stale":false,"commit_id":"deadbeef123"}`))
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "test-token")
+	review, err := client.PostReview(context.Background(), "owner", "repo", 3, "APPROVED", "LGTM", "deadbeef123", nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if review.ID != 101 {
+		t.Errorf("expected review ID 101, got %d", review.ID)
+	}
+	if review.CommitID != "deadbeef123" {
+		t.Errorf("expected commit_id %q, got %q", "deadbeef123", review.CommitID)
+	}
+}
+
 func TestGetPullRequest_Non200(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusNotFound)

github/review.go

@@ -103,7 +103,7 @@ func (c *Client) PostReview(ctx context.Context, owner, repo string, number int,
 	// the resolved commit_id.
 	for _, comment := range req.Comments {
 		if comment.CommitID != "" {
-			if payload.CommitID == "" {
+			if payload.CommitID == "" { // only reachable when req.CommitID is empty
 				payload.CommitID = comment.CommitID
 			} else if payload.CommitID != comment.CommitID {
 				return nil, ErrConflictingCommitIDs