fix(web): stop pull request metadata overlapping and mark links external

[rynfar]

Two small defects on the pull requests surface. A long branch or title pushed the
row's metadata into the adjacent element instead of truncating, so the row read as
overlapping text at narrow widths. Separately, links out to the forge opened
without external-link treatment, giving no signal that they leave the app.

Row metadata now truncates within its own track, and forge links are marked
external.

Adopted from upstream pingdotgg/t3code#8790 (cefec32d6) and #8856
(e9c4775e8), both cherry-picked clean. Grouped because both are pull-request-row
presentation.

Verified: vp test run --dir apps/web apps/web/src/components/pullRequest,
vp run -F @t3tools/web typecheck (exit 0, no errors).

Visual change, not exercised in a browser — happy to do a real-client pass on request.

Reviewed and integrated with Claude Opus 5 in Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.7 KiB	+168 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.8 KiB	+167 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.2 KiB	58.7 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	10	11	+1 (+10.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	+15 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−7 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.7 KiB	+22 B (+0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.1 KiB	58.1 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 9ade80d · PR result: 7ea6721 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Adversarial review found no correctness defects. It confirmed both commits are byte-identical cherry-picks with Pylon pre-images matching upstream, and checked the subtle bits: the meta-line separator keys stably as matchedElsewhere toggles, cn/tailwind-merge keeps sr-only and flex/truncate in separate groups, @xs/pr-row-meta:truncate does beat @xs/pr-row-meta:not-sr-only on Tailwind 4.3 registration order, container-type: inline-size on a minmax(0,1fr) grid item can't cycle, the checks popover is portaled so the new overflow-hidden can't clip it, and contain-intrinsic-block-size:54px still matches the two-row grid.

Three presentation-level findings. One fixed, two recorded.

Fixed: the header used two glyph vocabularies for one action — the inline link got ExternalLinkIcon while the same "open on host" item in the overflow menu kept ArrowUpRightIcon. Both now use ExternalLinkIcon.

Recorded, not fixed — these are upstream's responsive design calls and want the browser pass the PR body already asks for:

• PullRequestRow.tsx:119 — below the 20rem @xs/pr-row-meta threshold the author login goes sr-only and the match label goes hidden, recoverable only through hover tooltips on non-focusable spans. Worth noting the review slightly overstated this: the avatar still renders and sr-only keeps the login in the accessibility tree, so screen-reader users are fine. The gap is sighted touch users on phone widths, who get an avatar and no name.
• _chat.pull-requests.tsx:1872 — searchExpanded = searchOpen || searchValue.length > 0 hides the condensed <h1> whenever a query exists, even on a wide window with slack in the min-w-0 flex-1 spacer. Every other control in the diff degrades by width instead.

Re-verified: apps/web/src/components/pullRequest 289 passed, @t3tools/web typecheck clean.