fix(merge-guard): bind --match-head-commit to close the dropped-constraint case (#1042)

Add --match-head-commit (value-taking) to the merge denylist. An approval carrying --match-head-commit <sha> that is then executed without it now REFUSES via set-equality on the bound flag, closing the silent head-SHA-constraint drop.

Author: michael-wojcik

pact-plugin/hooks/shared/merge_guard_common.py

@@ -472,6 +472,10 @@ def _extract_force_push_target_ref(command: str) -> str | None:
         "--admin":         (("--admin",), False),               # bypass branch protection
         "--delete-branch": (("-d", "--delete-branch"), False),  # side-effect: deletes source branch
         "--repo":          (("-R", "--repo"), True),            # cross-repo redirect (value-carrying target)
+        # value-carrying SAFETY constraint (pins the merge to a head SHA); binding
+        # it closes the dropped-constraint case — approve with --match-head-commit,
+        # execute without it -> set-equality REFUSES (#1042).
+        "--match-head-commit": (("--match-head-commit",), True),
     },
     "close": {
         "--repo":          (("-R", "--repo"), True),            # cross-repo redirect (value-carrying target)