Harden issue PR publication reliability

[Wibias]

Summary

Fixes the publication-reliability defects reproduced by the full Grok commit + PR trace:

• machine-readable gh subprocesses remain colourless even when the parent environment forces ANSI/TTY output;
• issue-owned create-PR workflows use the canonical validated publication planner instead of rediscovering mutation JSON;
• an explicit publication-only request can terminate after verified PR creation instead of drifting into assignment, comments, or merge-ready work;
• leaving OPEN_PR still requires the locked push and create-PR receipts.

Regression evidence

RED-first coverage reproduced the publication gaps. The later Node 22 regression was traced to older tests that bypassed the new publication-plan boundary; those tests now construct the required locked plan instead of weakening production enforcement.

Verification

Exact head: b38a1d8c59d3623b28ec88d40c993d14a891effb

• CI: success
• Dependency Review: success
• Windows trace bins: success
• CodeQL: success

Scope

Publication reliability only. Evidence integrity, controller state grounding, and trace diagnostics are isolated in #434, #436, and #437.

Ready for review. Do not merge without explicit instruction.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 5a7bfec7-f5dc-4f55-9915-90030f2b6d71

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}