Should we enforce last pusher cannot approve in Mergify?

[oxarbitrage]

Today I rebased two fork PRs (#10570, #10590) to fix CHANGELOG conflicts and pushed to the fork branches. GitHub warned that my approval should not count since I was the last pusher — but Mergify merged them anyway because its queue rule only checks #approved-reviews-by >= 1 without enforcing that constraint.

This means a maintainer who pushes to a fork branch can also approve and merge it, bypassing the intent of the "someone else should approve new changes" safeguard.

Options:

1. Add the rule to Mergify — require the approver to be different from the last pusher. This means fork rebases always need a second team member, even for trivial CHANGELOG conflicts.

2. Leave as-is — Mergify accepts any approval. The GitHub UI still warns, and we rely on maintainers to use judgment. For cases where the rebase is trivial and the review was already thorough, this avoids unnecessary round-trips.

3. Middle ground — enforce the rule only for PRs with specific labels (e.g., A-security) where the extra check matters most.

Context: both PRs had deep local review (code, constants, tests, clippy, fmt) before the rebase. The push was purely mechanical (CHANGELOG conflict resolution). Requesting a second approval would have added latency for a rubber-stamp.

Thoughts?