ci(spend-logs-guard): run only on pull_request_target, re-run by hand after approving (#48941)

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/workflows/spend-logs-guard.yml

@@ -4,10 +4,6 @@ on: # zizmor: ignore[dangerous-triggers] runs the base branch's code only; the P
   pull_request_target:
     branches:
       - main
-  pull_request_review:
-    types:
-      - submitted
-      - dismissed
 
 permissions:
   contents: read

ci_cd/spend_logs_guard.py

@@ -6,7 +6,7 @@ so a path rule would put every migration on the owner. This gate reads the diff
 added line in the watched files mentions the table it passes at once, otherwise it passes only once
 the owner's latest review on the pull request is an approval that still covers every spend-log line
 in the head (approvals survive pushes, so a later commit may not add spend-log lines the owner never
-saw). The workflow re-runs on every review.
+saw). Reviews do not trigger the workflow, so the check is re-run by hand after approving.
 """
 
 from __future__ import annotations
@@ -153,7 +153,7 @@ def main(argv: Sequence[str]) -> int:
         else f"LiteLLM_SpendLogs lines changed after @{args.approver} approved {approval.commit_id}, "
         f"a new approving review is needed:\n"
     )
-    sys.stdout.write(f"{reason}{listed}The check re-runs when a review is submitted.\n")
+    sys.stdout.write(f"{reason}{listed}After approving, re-run this job.\n")
     return 1