Print the pull request preflight's GitHub state and report from agentrepo pr #915

Problem

The second half of preflight.sh reads GitHub and the machine: the account gh is signed in as, the existing pull requests for the branch, repository defaults, available labels, open milestones, open issues, the template sections, the pre-approval the session holds, the confirmation sources, the reviewer and stamp presence, the preconditions and the draft's state, including the stale-draft sweep that removes a leftover draft matching no open pull request and the creation of a draft when none exists. This is the report the pr skill reads before every publish, and agent-pr runs the same script.

Part of #588 and #323. Delivers in Go the behavior of the GitHub, machine, review, precondition and draft sections of packages/agents/source/skills/pr/shared/scripts/preflight.sh, completing the Go preflight report with child 05. This change adds Go behavior only and switches no caller.

Acceptance criteria

1. AC1: Given the active gh account, when the report prints, then the identity is read through GraphQL viewer.login and the report succeeds when REST core is rate limited; given gh is not installed, then the GitHub sections say so and the report continues.
2. AC2: Given an open or closed pull request for the branch, when the report prints, then == existing pull request == shows its number, state, draft flag, title and URL, and says one is open and that re-running publication updates it; given none, then it says none for the branch.
3. AC3: Given the repository, labels, open milestones and open issues, when the report prints, then == repository == lists the name, default branch, labels other than the owner-review label, open milestones and open issues within the shell's caps, and reports more than 100 open milestones as an error.
4. AC4: Given a template, when the report prints, then == template sections == lists its level 2 headings in order, says so when it declares none, and says there is no template and to stop when the file is missing.
5. AC5: Given a session pre-approval for the pr or merge scope, a configured delegation checker, and a configured or unconfigured machine gh_login, when == pre-approval == prints, then it reports each grant (and its biometric backing), whether a delegation checker is configured and the configured login or that none is, as the shell does, and does not call the delegation checker or resolve --confirmed.
6. AC6: Given the harness, the reviewer and a review stamp present or absent, when == review == prints, then it reports the harness, the reviewer, and stamp: present or stamp: none without verifying the stamp.
7. AC7: Given the preconditions, when == preconditions == prints, then it reports whether the draft is gitignored, the description lint command (the configured lint_pr_cmd in unattended mode, refusing an empty value, otherwise whether mise run lint-pr-description is present), and whether the pr and review-pr-description skills are deployed; given gh-post is not available, then preflight stops at the start of this section with the shell's missing-command message and exit status and prints none of the remaining preconditions, the draft section or later output.
8. AC8: Given a leftover draft matching no open pull request, when preflight runs attended, then it is removed, the review stamp is cleared and the report says so; given a draft matching an open pull request, then it is kept and compared with the published body, saying whether it matches.
9. AC9: Given unattended mode, when a draft matches no open pull request, then it is preserved with its review bound and not removed; given gh is not installed, then the draft is preserved and the report says it cannot tell whether it is stale; given the pull request lookup fails, then preflight stops with the error.
10. AC10: Given no draft or an empty draft, when == draft == prints, then the draft is created by the scaffold behavior of child 04 and the result is reported; given an existing draft, then it is left alone.
11. AC11: Given a rate-limit error from GitHub, when preflight runs, then it exits with status 76 and the message the shared classifier prints.
12. AC12: Non-functional: counted as invocations of gh made by the report (not requests the gh program makes internally), the report makes exactly: 7 when the branch has no pull request or an open one and no draft is compared (the viewer identity, two pull request lists, one repository view, one label list, one milestone query, one issue list); 8 when a draft with a level 1 title line sits beside an open pull request (the seven plus one read of the published body); 0 when gh is not installed; and 2 when the first pull request list fails (identity, then the failing list), after which the report stops with the error.

Scope and non-goals

Scope: the sections above and the complete Go preflight report assembled from this child and child 05, with the review bounds and persistent-review behavior of #770 reported and preserved in unattended mode.

Non-goal: the branch-state sections from child 05. Non-goal: verifying the review stamp, which child 07 owns. Non-goal: running the description lint or any gate; preflight only reports the lint configuration. Non-goal: changing confirmation precedence, which #762 owns. Non-goal: switching the shell caller, which child 12 does.

Approach

Meet AC1 to AC12 with failing table-driven cases first, using a fake gh and the machine configuration readers from #321, and compare the whole report with the captured shell output on the Bats fixtures. The unattended outcomes follow the regressions in tests/skills/agent-pr/authority.bats.

Dependencies

Blocked by: #910, #913, #914, #760 (quota and identity), #762 (confirmation and delegation), #770 (bounded persistent review).

Prerequisite: #321 (harness context and configuration readers).

Size

M. One pull request. Estimated under 700 changed code lines with tests.

Verify plan

• AC1, AC11: tests with a fake gh that rate limits REST, returns a rate-limit text, and is absent from PATH.
• AC2, AC3, AC4: Go tests over a fake gh and a scratch template, including a missing template and an over-limit milestone list.
• AC5, AC6: Go tests with configuration files, session ids and a checker stub that records any call (none is expected).
• AC7: Go tests with and without mise, a gitignored draft and absent skills, attended and unattended.
• AC8, AC9: tests over a scratch repository with drafts and a fake pull request list, attended, unattended, without gh, and with a failing lookup; the existing authority.bats cases are the oracle.
• AC10: a test with no draft and an empty draft, checking the scaffolded bytes equal child 04's.
• AC12: a recording fake gh counts invocations in the four scenarios above (no pull request, open pull request with a titled draft, gh absent, failing first list) and asserts 7, 8, 0 and 2; the AGENTS.md calls table is the category reference.
• AC7 (missing gh-post): a test with gh-post absent from PATH asserts the exit status, the message and that the report ends at the preconditions heading.
• Go tests run in the existing Go CI on macOS, Linux and Windows.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

The stale-draft sweep deletes a file and clears the review stamp, so a wrong match against open pull requests would remove a live description, and an unattended run must never delete. The AC8 and AC9 cases are the control. Undo: revert the change; nothing calls the Go report yet and the shell report remains.

Operator authority

None.