fix: skip direct push when an open PR already targets the same image:tag

Before committing and pushing, query the Gitea API for open PRs in the
apps repo. If any open PR modifies the same kustomization.yaml path and
its diff contains the target tag, exit 0 — the PR is the intended review
gate and the direct push would bypass it.

Fails open on API errors so an outage does not block all deploys.

Fixes bug-nxhza9j2atqk

action.yaml

@@ -67,6 +67,37 @@ runs:
           exit 0
         fi
 
+        # Detect an open PR already targeting the same image:tag in the same
+        # kustomization.yaml. If one is open, defer to it so the review gate
+        # is the actual control path — not a race with the direct push.
+        GITEA_HOST="${APPS_REPO%%/*}"
+        GITEA_REPO_PATH="${APPS_REPO#*/}"
+        GITEA_API="https://${GITEA_HOST}/api/v1"
+        KUSTOMIZATION_FILE="${PATH_IN_REPO}/kustomization.yaml"
+
+        BLOCKING_PR=""
+        PR_NUMS=$(curl -sf -H "Authorization: token ${TOKEN}" \
+          "${GITEA_API}/repos/${GITEA_REPO_PATH}/pulls?state=open&limit=50" \
+          | jq -r '.[].number' 2>/dev/null || true)
+
+        for pr_num in $PR_NUMS; do
+          FILES_JSON=$(curl -sf -H "Authorization: token ${TOKEN}" \
+            "${GITEA_API}/repos/${GITEA_REPO_PATH}/pulls/${pr_num}/files" || echo "[]")
+          if echo "$FILES_JSON" | jq -e \
+            --arg f "$KUSTOMIZATION_FILE" \
+            --arg t "$TAG" \
+            'any(.[]; .filename == $f and (.patch // "" | contains($t)))' \
+            > /dev/null 2>&1; then
+            BLOCKING_PR="$pr_num"
+            break
+          fi
+        done
+
+        if [ -n "$BLOCKING_PR" ]; then
+          echo "PR #${BLOCKING_PR} is open and already targets ${NAME}:${TAG} in ${KUSTOMIZATION_FILE}; deferring to PR"
+          exit 0
+        fi
+
         git -C "$WORK" add "${PATH_IN_REPO}/kustomization.yaml"
         git -C "$WORK" commit -m "$MSG"