feat(pm): add validated close-milestone primitive

[aleskalfas]

What

Add pkit project-management close-milestone <n> — a validated milestone-close primitive mirroring create-milestone / close-issue. Closes a GitHub milestone through the validated path (holding the grant the raw gh api path lacks), reads the close-trigger from time-containers.yaml (content-based refuses on open children unless --force; date-based warns + lists), supports --dry-run, and records an audit note in the milestone description (milestones have no comment thread). New executable entrypoint; wired in package.yaml; documented in the capability README.

Scope / deferrals (see #229 acceptance criteria)

• Content-based close — the observed need (2026-06-23 raw-gh api close) — is fully implemented + tested.
• Rollforward (date-based) is deferred: no rollforward routine exists anywhere yet (prose-only in DEC-016); date-based warns + lists open children. Tracked by [Task] Verify whether the workflow auto-rolls a milestone on close and file the gap if absent #387. (project-kit milestones are content-based only.)
• Cascade-eligibility surfacing (the optional criterion) is deferred to [Task] Surface milestone-close eligibility from the closure cascade when the last child EPIC closes #414 — it would touch the close-issue.py cascade path, outside this task.

Doc impact

Adds a "Milestone lifecycle — create-milestone / close-milestone" subsection to the capability README (close-trigger behaviour, membership resolution, audit-note substrate, the deferrals).

Surface / version

New CLI command = surface change (PRJ-002): .pkit/VERSION 1.131.1 -> 1.132.0 (minor), project-management component.version 0.42.0 -> 0.43.0 (minor).

Verification

• pytest tests/test_pm_close_milestone.py -> 23 passed; related milestone/close suites -> 78; full pm suite -> 1777 passed.
• executable bit 100755 (satisfies the [Test] CI guard: assert dispatcher entrypoint scripts are tracked executable #405 CI guard); ruff clean; migration check: no triggers.
• convention-compliance-reviewer: clean (the two version bumps were its sole finding, now applied).

Closes #229.

[aleskalfas]

Reviewer agent (local, reviewer): APPROVED

Applied the pm-conventions checklist to PR #415 against issue #229. All gate-blocking criteria pass; the verdict follows mechanically from the severity model in validation-severity.yaml.

Findings

• Branch shape — pass ([project-management:DEC-013-branch-and-pr-conventions], git-conventions.yaml branch-name). feat/229-add-a-validated-close-milestone matches ^(feat|fix|...)/[0-9]+-[a-z0-9-]+$.
• Branch-type / issue-type alignment — pass (pr_type_mapping). Issue [Task] Add a validated close-milestone primitive #229 carries type:feature; the mapping resolves feature → feat, and the branch's <type> is feat.
• PR title Conventional Commits — pass ([COR-008] + DEC-013). feat(pm): add validated close-milestone primitive parses as <type>(<scope>): <desc> with an accepted type.
• PR title type matches issue type — pass. feature → feat per pr_type_mapping; title type is feat.
• Issue classification complete — pass ([project-management:DEC-012-classification-axes]). [Task] Add a validated close-milestone primitive #229 carries type:feature, priority:Medium, workstream:capabilities (plus state:in-progress).
• PR body links to closing issue — pass (DEC-013, git-conventions.yaml pr-body). Closes #229 present and closingIssuesReferences populated. ## Doc impact section present (the hard-reject pr-body rule is satisfied).
• Surface-change discipline — pass ([COR-010]). New executable close-milestone.py plus command wiring is a pure addition; package.yaml schema_version: 2 is unchanged (only component.version 0.42.0→0.43.0), no renames/removals in kit-owned trees. Author reports pkit migrations check-diff: no triggers — consistent with the diff.
• No-shared-files invariant — pass ([COR-001]). All edits sit in the project-management capability tree, .pkit/VERSION, .pkit/adapters/claude-code/package.yaml, and tests/. This is project-kit's own source repo (self-hosting), which owns these trees, so the invariant is not implicated.

Warnings / notes (non-blocking)

• Adapter requires_backbone upper bound was broadened <1.132.0 → <1.133.0 to admit the backbone bump — consistent with the surface change; noted for completeness, no action needed.
• The date-based rollforward and cascade-eligibility deferrals are explicitly scoped out and tracked ([Task] Verify whether the workflow auto-rolls a milestone on close and file the gap if absent #387, [Task] Surface milestone-close eligibility from the closure cascade when the last child EPIC closes #414), and the AC checkboxes reflect that. Outside pm-conventions scope, but the traceability is clean.

Scope reminder: this verdict covers pm conventions only — code correctness, the close-trigger policy logic, and test adequacy are software-engineer / qa-engineer scope, not mine.