ci: reapprove internal PRs after a push dismisses an approval

[ggprior]

Copies the reapprove-internal-prs workflow from PriorLabs/TabPFN verbatim.

Branch protection dismisses every approval when new commits are pushed. For PRs whose author and previous approver are both org members, the workflow re-approves the new head automatically. It only acts when the dismissed review was an approval and was dismissed by a push, never when a reviewer dismissed it by hand, and it skips PRs from forks.

Prerequisite: the workflow reads org membership with the PRIORLABS_ORG_MEMBERSHIP_READ_PAT secret. I could not verify that secret is exposed to this repository. If it is org-level and scoped to selected repos, tabpfn-client has to be added before merging, otherwise the membership step fails and nothing is approved.

Labelled "no changelog needed" as a CI-only change.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e8b0f74. Configure here.}

[cursor]

Workflow grants write permissions globally

Low Severity

This workflow sets pull-requests: write at the workflow level instead of defaulting to empty permissions and granting write only on the reapprove job. That regresses the repository convention that workflow-level permissions stay empty and each job opts in.

 

^{Triggered by learned rule: GHA release workflows: SHA-pin, no interpolation, bot token}

^{Reviewed by Cursor Bugbot for commit e8b0f74. Configure here.}