feat: add pull request delivery skill (#1934)

* feat: add pull request delivery skill

Define the pre-change justification, scoped publication workflow, and CI/review completion gate for HardwareVisualizer pull requests. Preserve automatic review as the default and document sandbox-aware GitHub CLI handling.

* fix: clarify PR delivery authorization

Require an explicit publication or follow-through request before Git and GitHub mutations, while treating that request as authorization for the scoped delivery workflow. Qualify the whowns provenance without discarding it.

* fix: rely on automatic Codex reviews

Document that Codex decides when review is needed and must not be requested manually. Preserve the existing scoped re-review rule for other configured reviewers.

* fix: preserve PR delivery boundaries

Keep app-manager connector PRs draft unless merge is authorized so repository automation cannot bypass the publication boundary. Route non-obvious decisions to the smallest durable owner without requiring a consolidated record.

* fix: honor existing PR publication state

Update existing pull requests instead of creating duplicates and let the completion gate accept an intentional Draft state without weakening merge authorization.

* fix: scope reviews to publication state

Require only reviews that can run for the intended Ready or Draft state, align the promoted lesson, and record evidence-based Codex usefulness reactions without replacing replies or thread resolution.

* fix: cover all auto-merge PR authors

Preserve Draft state without merge authorization for both repository identities selected by auto-merge.yml, including existing Dependabot pull requests.

* fix: preserve existing PR publication state

Treat an existing Draft or Ready state as explicit user intent during follow-through while retaining auto-merge author safeguards.

* fix: track non-thread review feedback

Treat top-level comments and review submissions as completion items while resolving only inline threads.

* fix: guard pre-existing auto-merge

Treat auto-merge on an existing PR as merge intent and require user direction before checks or reviews can trigger an unauthorized merge.

* fix: verify requested PR merges

Require GitHub merged state and merged timestamp only when the user explicitly requested merge, while retaining publication completion for non-merge tasks.

* fix: clarify PR reuse authorization

Reuse only active PRs, preserve existing publication state, stop before bot-authored synchronization can enable auto-merge, and explicitly include review reactions in authorized follow-through.

* fix: require merge consent for bot Ready state

Do not treat a request to mark app-manager or Dependabot pull requests Ready as merge authorization because ready_for_review enables repository auto-merge.

* fix: match existing PR change contract

Reuse a pull request only when its active state, head and base repositories and branches, and current requirement match the change being delivered.

* fix: simplify pull request delivery guidance

Remove review-driven GitHub state handling that is not required by the delivery contract. Keep the skill focused on scoped publication, current CI and feedback, and a clear stopping condition.

* fix: bound automated review follow-up

Use one collected review and correction cycle, then rely on regression checks and CI. Do not wait for correction commits to trigger another automated review.

* fix: converge pull request review cycles

Separate broad primary review from incremental verification, require an approval state, and stop automatic correction after two non-converging verification rounds. Disable CodeRabbit review on every push so the skill requests focused incremental confirmation only after a complete correction batch.

* fix: retain incremental correction reviews

Keep CodeRabbit incremental reviews enabled so each correction push is verified. Bound follow-up work by accepting only unresolved primary findings or regressions introduced by the correction.

* fix: admit later critical review findings

Keep follow-up review focused on primary fixes and regressions while allowing verified merge-blocking security, data-integrity, supported-path, or contract failures. Defer minor new suggestions so they cannot create another correction push.

* fix: route critical findings by scope

Fix later merge-blocking findings only when the PR owns them. Track verified out-of-scope findings in a separate issue, while preserving private disclosure for vulnerabilities.

* fix: preserve pull request delivery boundaries

Match existing pull requests to the current change, preserve publication state, include human feedback, and require GitHub mergeability. Keep merge execution outside this approval-focused workflow.