I think you first need to make an assumption of good faith on the submitter’s part. Yes, someone actively hostile to a repo and trying to sneak in changes will be successful, they can just prompt around the challenge.
I think the bigger picture is there won’t be one catch-all solution and we’ll need to embrace the Swiss cheese model from the world of aviation safety, this is just a suggestion for one layer.
It raises the stakes though. Getting challenged for an AI slop PR isn’t great, but ok, try and redeem yourself. Getting caught trying to cheat that challenge, you might as well just close down your account, like what is the point of even spending tokens to do this? These slop PRs are just people trying to pad their GitHub profiles.