ci/github-script/commits: allow reason for not cherry-picking

This change allows giving a reason via footer of the commit message for
why this commit is not cherry-picked. This avoids having to "explain"
the automated review comment afterwards - instead, this explanation can
be given immediately when writing that commit.

For example, for an update of `xen` on the stable branch, this could be:

```
xen: 4.19.3-unstable-2025-07-09 -> 4.19.3

[... commit message ...]

Not-cherry-picked-because: unstable is on a different minor version
```

This would then be shown as part of the automated review. The severity
of this will be downgraded from "warning" to "important". We still treat
the review as "changes requested", because it would be very complicated
and noisy to handle two different categories of reviews, some with
requested changes and some with comments only.

An alternative would be to not show this review at all. However, given
that the reviewers expectation on backports should already be "if it's
not a clean backport, the automated review will tell me what to look
at", it seems better to show these and have the committer confirm by
dismissing the review. Otherwise we risk merging actually unreviewed
commits.

ci/github-script/commits.js

@@ -23,13 +23,25 @@ module.exports = async function ({ github, context, core, dry }) {
         pull_number
 
     async function extract({ sha, commit }) {
+      const noCherryPick = Array.from(
+        commit.message.matchAll(/^Not-cherry-picked-because: (.*)$/g)
+      ).at(0)
+
+      if (noCherryPick)
+        return {
+          sha,
+          commit,
+          severity: 'important',
+          message: `${sha} is not a cherry-pick, because: ${noCherryPick[1]}. Please review this commit manually.`,
+        }
+
       // Using the last line with "cherry" + hash, because a chained backport
       // can result in multiple of those lines. Only the last one counts.
-      const match = Array.from(
+      const cherry = Array.from(
         commit.message.matchAll(/cherry.*([0-9a-f]{40})/g),
       ).at(-1)
 
-      if (!match)
+      if (!cherry)
         return {
           sha,
           commit,
@@ -37,7 +49,7 @@ module.exports = async function ({ github, context, core, dry }) {
           message: `Couldn't locate original commit hash in message of ${sha}.`,
         }
 
-      const original_sha = match[1]
+      const original_sha = cherry[1]
 
       let branches
       try {
@@ -222,7 +234,7 @@ module.exports = async function ({ github, context, core, dry }) {
       // Whether this is intended or just an implementation detail is unclear.
       core.summary.addRaw('<blockquote>')
       core.summary.addRaw(
-        `\n\n[!${severity == 'warning' ? 'WARNING' : 'CAUTION'}]`,
+        `\n\n[!${({ important: 'IMPORTANT', warning: 'WARNING', error: 'CAUTION' })[severity]}]`,
         true,
       )
       core.summary.addRaw(`${message}`, true)