Add a deterministic PullRequest workflow effect

[taras]

Story

As a workflow author, I want PullRequest to create or reconcile one pull request for an explicitly pushed branch, so review operates on known remote state without hiding a push inside pull-request creation.

Contract

PullRequest uses the contextual Repository and forge provider. It requires the compatible Git.Push result from #370, derives stable identity from the WorkflowRun and expansion, and reconciles through #297.

The first production result stays minimal: stable provider identity, number, URL, state, head SHA, and base SHA. Reviews, comments, checks, and changing remote observations are separate reads/effects rather than an indefinitely fresh snapshot embedded in the creation result.

Acceptance

• PullRequest performs no implicit commit or push.
• Replay cannot create a duplicate pull request.
• Existing compatible state resolves to the same pull request.
• Conflicting head, base, repository, or pull-request state is diagnosed.
• Interruption after remote creation reconciles by provider observation.
• The result identifies the exact head and base SHA and remains valid as the recorded creation outcome.
• Review verdicts bind to the head SHA they actually inspect.
• Provider-specific payloads do not leak into the public component contract.

Dependencies

• Add a deterministic Git.Push workflow effect #370 supplies explicit remote branch publication.
• Add shared external forge-effect reconciliation #297 supplies shared forge-effect reconciliation.
• End goal: Document adversarial implementation workflow WIP #181.