Let an author move their change request's head from the browser

Fixes #01M5XMWZ31K4607MHTXCD2VNZE.

Why

A change request names the exact commit under review, so a fixup pushed after it was opened is invisible until the head moves. The only mover was vole change update <id> --head <rev>, which writes refs/heads/vole — a write only a maintainer can make. A contributor could push to their own branch and open a request, but could not keep that request current; the alternatives were asking a maintainer or opening a second request and losing the discussion.

What changed

The request sidebar’s Review section now has a Move head to control, offered to the request’s author and to maintainers while the request is open:

Base   main
Head   43f98bcd
Move head to [ contrib/alice/fix-timeout ▾ ] [Update]

POST /r/{name}/requests/{id}/head resolves the chosen branch on the server and writes the new head with metadata.SetRequestHead, in one metadata commit, audited as web.request.head. Approvals stay in the tree as history and stop matching the new head, which is what a new head already meant.

The handler applies the rule the browser already applies when opening a request (CreateChangeRequest): the head must be a branch tip, and a contributor may only name a branch under refs/heads/contrib/<their-account>/ (access.IsContributorRef). Maintainers may name any normal branch. The picker uses the same filtered list, so it cannot offer a branch the handler would refuse.

metadata.SetRequestHead now refuses a closed or merged request. That is the same rule SetRequestCloses already states, and putting it in the writer means the CLI and the browser agree instead of the web handler owning it alone.

Checks

• vole workflow check, vole workflow run verify (format, vet, build, govulncheck, packages, links, go test -race ./...).
• New tests: TestContributorMovesTheirOwnRequestHead drives a contributor account through opening a request, pushing a fixup, moving the head, being refused a foreign branch, a maintainer moving the same request, and a closed request refusing the move. TestSetRequestHeadMovesOnlyAnOpenRequest pins the writer’s refusals for closed and merged requests.