fix(coding): validate live PR merge arguments

[levineam]

Motivation

• The live PR merge adapter constructed gh pr merge argv from caller-controlled prNumber and mergeMethod, allowing option-looking values such as --admin to be forwarded to the CLI and enabling privileged behavior escalation.
• The intent of the change is to harden the adapter by rejecting invalid/option-like PR selectors and by restricting merge methods to an explicit allowlist to prevent CLI option injection.
• The fix aims to be minimal and preserve existing merge behavior for valid inputs while preventing attacker-controlled inputs from shaping gh flags.

Description

• Added an allowlist ALLOWED_MERGE_METHODS and a normalizeMergeMethod helper that enforces that the merge method is one of merge, rebase, or squash.
• Added a normalizePullRequestNumber helper that requires the PR selector be a positive integer and used both normalizers before building the gh argument vector in merge.
• Added a regression test live PR adapter rejects option injection in merge inputs that verifies option-looking selectors and unauthorized merge methods are rejected and that the command runner is not invoked for invalid inputs; the changes touch modules/jarvos-coding/src/adapters/live/pull-request.js and modules/jarvos-coding/test/live-adapters.test.js.

Testing

• Ran node --test modules/jarvos-coding/test/live-adapters.test.js and the file-level suite passed with 17 passing tests and 0 failures.
• Ran npm test for the @jarvos/coding module and the full module test run passed with 125 passing tests and 0 failures.
• The new regression test asserts that invalid inputs are rejected without invoking the underlying runner, and it passed as part of the above test runs.

---

Codex Task