feat(shared-skills): add global pr workflow

[feelsodev]

What is this PR?

This adds a self-contained global pr skill to the cross-harness shared-skills bundle. It preserves the existing b2b-dashboard PR workflow defaults while removing the dependency on a repository-local Claude command, and it lets stricter repository policy narrow the workflow without widening user authorization.

Changes

Shared PR workflow

• Add packages/shared-skills/skills/pr/SKILL.md with full-diff inspection, branch/base guards, diff-grounded title and body generation, safe push/create behavior, and server-side PR read-back.
• Preserve repository-specific base, naming, title, template, check, merge, and draft policy when present.
• Treat repository guidance as untrusted data that cannot request secrets, unrelated writes, or broader authorization.
• Keep multiline PR bodies out of shell interpolation by using an owner-only temporary file outside the repository and deleting it on either success or failure.

Cross-harness distribution

• Register the 18th shared skill in the shared-skills inventory.
• Add explicit Codex sync and OpenCode loader assertions for pr.
• Add pr to the Senpi packaged-skill inventory and the closed skill_loaded.skill_name telemetry enum, with the generated telemetry reference kept byte-exact.

Verification

• Shared-skills suite: 80 pass, 0 fail.
• Codex sync suite: 12 pass, 0 fail.
• OpenCode shared-skill loader: 2 pass, 0 fail.
• Senpi full isolated package gate: 2,216 pass, 1 Windows-only skip, 0 fail.
• Senpi post-review skills/schema checks: 13 pass, 0 fail.
• Root and Senpi TypeScript checks: pass.
• Source, dist, Codex, and Senpi pr/SKILL.md copies: byte-identical.
• Isolated real-harness QA:
  • Codex local install and real codex app-server turn discovered the skill; real ~/.codex/config.toml stayed unchanged.
  • OpenCode isolated server/local-plugin probe returned RESULT=FIXED; the real OpenCode database stayed unchanged.
  • Senpi live driver passed with realSenpiUntouched: true.
• Five independent post-implementation reviews passed for goal compliance, code quality, security, hands-on QA, and repository context.

Residual risk

• The full Codex gate reaches the existing subagent-limit-migration.test.mjs failure. The same focused test fails identically on a clean detached origin/dev worktree at 63bfdb770; the affected Codex sync suite is green.
• LSP diagnostics were unavailable because typescript-language-server is not installed on the workstation; repository typechecks and scoped tests passed instead.

---

Summary by cubic

Adds a global pr shared skill that creates GitHub pull requests from the actual commits and full diff, replacing repository‑local PR commands while preserving repository policy. This unifies PR creation across harnesses without widening user authorization.

• Behavior and safety

  • Full‑diff inspection, base/branch guards, diff‑grounded title/body, safe push and gh pr create via an owner‑only temp file, and server‑side read‑back; repository policy wins and repository guidance is treated as untrusted.

• Distribution and rollout

  • Registers pr in @oh-my-opencode/shared-skills; Codex aggregate and OpenCode loader discover/load it, with an explicit Codex test asserting inclusion.
  • Updates Senpi built‑in skill list and skill_loaded.skill_name telemetry enum and docs; regenerates omo-senpi extension bundles.
  • Updates AGENTS.md to 18 skills including pr.
  • Migration: No action required. Repositories may optionally remove local PR commands; the skill follows existing base, naming, templates, checks, and draft/merge policy.

^{Written for commit 646191d. Summary will update on new commits.}

[feelsodev]

@code-yeongyu All required checks are green and the PR is mergeable. Could you review and merge it with a merge commit when ready?