fix(external-plugins): block approval during intake reruns

Remove stale ready-for-review state before evaluating edited submissions or running quality gates. Require a current ready state before fast-tracking or approving, and cover the pending transition with focused tests.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 821f4796-505e-4fb8-96cf-0b5bbf80a636

.github/workflows/external-plugin-command-router.yml

@@ -85,7 +85,8 @@ jobs:
             });
 
             const fallbackName = evaluation.plugin?.name ?? `issue-${context.issue.number}`;
-            const canApprove = labelNames.has('ready-for-review') || labelNames.has('approved');
+            const canApprove = labelNames.has('approved') ||
+              (labelNames.has('ready-for-review') && !labelNames.has('awaiting-review'));
             const canReject = !labelNames.has('approved');
 
             if (parsedCommand.command === 'approve' && !canApprove) {

.github/workflows/external-plugin-intake.yml

@@ -48,6 +48,22 @@ jobs:
             core.setOutput('issue-labels', JSON.stringify(labels));
             core.setOutput('should-sync', (!isApproved && !isClosedWithoutReopen) ? 'true' : 'false');
 
+      - name: Mark submission as awaiting review
+        if: steps.guard.outputs.should-sync == 'true'
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        with:
+          script: |
+            const path = require('path');
+            const { pathToFileURL } = require('url');
+            const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);
+
+            await intakeState.markExternalPluginIntakeAwaitingReview({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issueNumber: context.issue.number
+            });
+
       - name: Evaluate submission
         id: evaluation
         env: