ci(cutover): no Closes listed twice, room for the worst case, the checkout pinned (D332)

From the second review:
- A PR whose merge commit main already has is not listed again. edge's tip at
  a cutover is often that PR's merge commit, and its merged_at can be a moment
  after the cut-off's committer date, so its issues would have had the next
  release's comment too.
- timeout-minutes 240: the worst case is about 200, and a timeout must never
  cut off the step that starts rust-carbon again.
- A test pins the checkout: edge, except on a dry dispatch that names code_ref.

Dry run (CI run 54, before these): every gate refused for the right reason.
Public Rust is still the 22 October build, which lacks the three fields edge
carries for November, and gates 1 to 4 each saw it; the panel key wrote to,
restarted and read rust-carbon; the live half ran 266 pass, 0 fail; nothing
was opened, edited, commented or merged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

tools/drill/cutover.js

@@ -451,11 +451,21 @@ async function closesSinceCutOff(g, deps) {
   try {
     since = Date.parse(deps.git('log', '-1', '--format=%cI', deps.git('merge-base', 'origin/main', 'origin/edge'))) || 0
   } catch {}
+  // A PR whose merge commit main already has shipped in an earlier cutover, even when its merged_at is a moment
+  // after the cut-off's committer date (edge's tip is often that very merge commit).
+  const shipped = (sha) => {
+    if (!sha) return false
+    try {
+      return /\borigin\/main\b/.test(deps.git('branch', '-r', '--contains', sha, '--list', 'origin/main'))
+    } catch {
+      return false
+    }
+  }
   const bodies = []
   for (let page = 1; page <= 10; page++) {
     const prs = await g.call('GET', `/pulls?state=closed&limit=50&page=${page}`)
     for (const pr of prs) {
-      if (pr.merged && pr.base && pr.base.ref === 'edge' && Date.parse(pr.merged_at) > since) bodies.push(pr.body)
+      if (pr.merged && pr.base && pr.base.ref === 'edge' && Date.parse(pr.merged_at) > since && !shipped(pr.merge_commit_sha)) bodies.push(pr.body)
     }
     if (prs.length < 50) break
   }