[FEATURE] Create pull requests and merge/rework gates from approved workforce output

[Joncallim]

Roadmap source

docs/roadmap.md -> P2 Workforce and Autonomous Coding -> Next execution slices 7-8.

Problem

Forge should eventually turn approved specialist output into commits and GitHub pull requests, then require merge/rework decisions. This must build on VCS evidence and QA/Reviewer gates rather than jumping straight from generated output to merge.

Concrete plan

1. Add PR creation only after repository evidence, validation output, QA gate, and Reviewer gate are complete.
2. Persist commit SHA, branch, PR URL, check status, and merge readiness in vcs_changes.
3. Add a final human merge approval gate with explicit rework and cancel paths.
4. Poll or refresh GitHub check status with clear degraded states when GitHub auth is missing.
5. Keep automatic merge disabled until all required gates are green and the operator approves.

Acceptance criteria

• Forge can create a PR from an approved branch and attach the PR URL to the task.
• CI/check status is visible and blocks merge readiness while pending/failing.
• Rework sends the task/package back to an actionable state with the review reason.
• Merge is impossible without final human approval.

Validation

• GitHub integration tests/mocks for PR creation and check status mapping.
• API tests for merge/rework gate transitions.
• UI tests for PR/check/merge readiness states.
• npm run lint, npx tsc --noEmit, npm test, npm run build.

[Joncallim]

Task lifecycle refinement:

Default behaviour for each new project task should be branch-and-PR oriented.

Add to this issue's intended behaviour:

• For a Git-backed project, Forge should create or use a task-specific branch by default.
• After implementation, validation, and required review gates pass, Forge should create a GitHub PR by default.
• This should still build on [FEATURE] Add repository evidence and scoped command audit for work packages #68's repository evidence and scoped command-audit layer.
• Task detail should show branch name, commit SHA, PR URL, check status, and merge readiness.
• Merge remains human-approved. The default is branch plus PR creation, not automatic merge.