fix(rollback): guard unsafe rollback requests

[aparajon]

Summary

• Reject rollback requests unless the requested apply is completed, scoped to the requesting PR/environment, and has stored original schema.
• Require rollback plan requests to target an apply by apply_id + environment; the database is derived from the stored apply instead of accepted from users.
• Reject -d on rollback and rollback-confirm PR commands so rollback flows are not database-scoped through compatibility flags.
• Ensure rollback only proceeds when the current planner would target that exact latest completed apply, avoiding cases where one apply is validated but a different apply is rolled back.
• Post a rollback-specific rejection comment that explains the safety gate instead of a generic command error.

This keeps self-service rollback fail-closed while the selected-apply rollback planner is split out into follow-up work.

Generated with Amp.

[Copilot]

Pull request overview

This PR adds guardrails to ensure SchemaBot rollback requests fail closed unless the requested apply can be proven safe to target (latest completed apply for the scoped database/environment, and backed by stored original schema), and introduces a rollback-specific rejection message for those safety-gate denials.

Changes:

• Added ValidateRollbackSourceApply guardrails in the API layer to reject unsafe/ambiguous rollback targets.
• Updated the webhook rollback flow to use the new guardrails and post a dedicated “Rollback Not Allowed” message on rejection.
• Added tests covering the new rejection template and rollback guardrail scenarios.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/webhook/templates/rollback.go	Adds a rollback-specific rejection comment renderer and data struct.
pkg/webhook/templates/rollback_test.go	Adds coverage for the new rollback rejection template and whitespace checks.
pkg/webhook/rollback.go	Routes rollback requests through the new guardrails; acquires/releases locks around rejected planning paths; posts rollback-specific rejection comments.
pkg/api/handlers_test.go	Extends test stores/mocks to support the new guardrail logic and adds guardrail-focused tests.
pkg/api/control_handlers.go	Implements ValidateRollbackSourceApply and supporting helpers used by webhook + HTTP rollback-plan handling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.