test: reviewer action allowlist tag labels are not checked against an independent expectation #698

packages/cli/test/reviewer/ci-job.test.ts checks that each reviewed action pin in scripts/reviewer/ci-job.mjs has a SHA and a well-formed release tag, and that the planner reports a tag for each workflow ref, but the expected tags come from the same allowlist, so a wrong tag label on an entry stays green (8 of the 11 entries). Acceptance is keyed on the SHA, so this is lost test coverage, not a live defect: every current SHA-to-tag pair is correct.

Fix: add a reviewed SHA-to-tag fixture to the test and assert the allowlist matches it, keep reading workflow refs from the workflows but take the expected tag from the fixture, rename the "with its release tag" test to say what it checks, and correct the unreleased changelog fragment fixed-renovate-action-bumps.md to say tags come from the reviewed allowlist.

Found by the post-merge audits of #695 and #696 (2026-10-26) and verified on main 43635a7 by mutation (verified severity: LOW).