codeowners: allow owner signoff through Comment reviews

[staging-devin-ai-integration]

Related PR(s)

Companion https://github.com/usacognition/devin-webapp/pull/91587 updates the pinned
binary and dispatches review events for directive submissions and body edits.

Summary / Background

COMMENTED + standalone codeowners-approved satisfies every required owner
group the signer belongs to. APPROVED processing, review thresholds, and
allow_self_approval retain their existing semantics.

The newest valid signoff per reviewer survives unrelated comments and is
superseded by a later request-changes or dismissed review. Editing away a
directive withdraws that review's signoff. Smart dismissal checks owned-file
changes without attempting to dismiss Comment reviews. If ownership depends on
a signoff, enforcement cannot turn it into an ordinary GitHub approval.

The Go parser and receiver use the same JSON compatibility cases for standalone
lines, Markdown containers, fenced/indented code, HTML, case, and whitespace.
List indentation survives blank lines so nested paragraphs do not become
directives; the fixtures cover both continued lists and deindented signoffs.
Fences interrupting list/quote paragraphs are recognized before skipping their
content, so blank lines inside examples cannot expose directives.

Validated with Go 1.23.12: go build ./..., go test ./..., go vet ./..., and
./scripts/covbadge.sh (100% statement coverage in the new directive parser).
Receiver checks also validate the shared fixtures and confirm that the existing
primary bot approval gate excludes signoffs. No live GitHub reviews were posted.

Release notes

Owners can sign off on their areas with a codeowners-approved Comment review
without giving the pull request an approving review.

Link to Devin session: https://staging.itsdev.in/sessions/cb452606a1134c548e161db7a0047e95
Open in Devin Desktop: https://staging.itsdev.in/desktop/session/cb452606a1134c548e161db7a0047e95?variant=devin-insiders
Requested by: @etw-cognition

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[staging-devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Ethan Wu

SYSTEM:
<latest_message>
Ethan Wu (U095C1GNK55) [ts=1788915346.289999]: @Devin I want to extend our codeowners-plus implementation (the one in buildkite) to support reviewers signing off on the owner requirement without leaving an approving review on the pr. for example, as an api-v3 owner, I want to be able to sign off on changes to apiv3 without leaving a review that would satisfy the primary review gate.
</latest_message>

=== BEGIN THREAD HISTORY (in #devin-runs) ===
Ethan Wu (U095C1GNK55) [ts=1788915346.289999]: @Devin I want to extend our codeowners-plus implementation (the one in buildkite) to support reviewers signing off on the owner requirement without leaving an approving review on the pr. for example, as an api-v3 owner, I want to be able to sign off on changes to apiv3 without leaving a review that would satisfy the primary review gate.
=== END THREAD HISTORY ===
Channel ID: C06B101VBAQ
Thread URL: https://cognition-ai.slack.com/archives/C06B101VBAQ/p1788915346289999?thread_ts=1788915346.289999&amp;cid=C06B101VBAQ

The <latest_message> is the message that you should use to guide your goals + task for this session, and you should use the rest of the slack thread as context.
A [ts=...] marker on a Slack message is that message's timestamp. To act on a specific message with the slack tool (e.g. adding an emoji reaction via the reaction command), pass that value as timestamp along with the Channel ID — no extra lookup call is needed.