Auto-suggest opening a PR upon session completion

[dhilgaertner]

Summary

• Append steps 3-6 (implement, commit, push, open PR) to the initial prompt emitted by ClaudeLauncher so Claude Code wraps up each session by opening a provider-specific PR/MR linked to the ticket via Closes #<n>.
• When the ticket URL is itself a /pull/ or /merge_requests/, skip the "open a PR" step and tell the agent to push to update the existing PR instead.
• Keep skills/crow-workspace/SKILL.md in sync with the ClaudeLauncher template (including the "existing PR detected" override).
• Strengthen existing ClaudeLauncherTests and add two new cases covering GitHub PR URLs and GitLab MR URLs.

Closes #196

Test plan

• swift test --package-path Packages/CrowClaude — 10/10 pass
• make build — succeeds
• Launch a fresh /crow-workspace <github-issue-url> session and confirm the generated prompt contains the gh pr create ... --body "Closes #<n>" step
• Launch /crow-workspace <gitlab-issue-url> and confirm the glab mr create ... step is emitted
• Launch /crow-workspace <github-pr-url> and confirm the prompt instructs pushing (no new PR)

🤖 Generated with Claude Code

[dgershman]

Code & Security Review

Critical Issues

None found.

Security Review

Strengths:

• No user-controlled input flows into the shell commands embedded in the prompt template — ticket numbers are Int? (not arbitrary strings), so injection into the Closes #N syntax is not possible.
• The isPullRequestURL check uses simple substring containment (/pull/, /merge_requests/), which is correct and not bypassable in a meaningful way given the URL is already stored server-side.
• Existing security measures (prompt file 0o600 permissions, shellEscape for paths) remain intact and unaffected by this change.

Concerns:

• None.

Code Quality

Well done:

• Clean separation of appendOpenPRStep as a private helper — keeps generatePrompt readable.
• isPullRequestURL is a static function (no actor isolation needed), appropriate since it's a pure function.
• All provider/ticket-number combinations are covered: GitHub with/without ticket number, GitLab with/without, nil provider, and the PR-URL override path.
• Tests are thorough — 10/10 pass. New tests cover both the GitHub PR and GitLab MR "ticket is already a PR" paths, and existing tests were strengthened with assertions for the new steps 3-6.
• SKILL.md stays in sync with the ClaudeLauncher template, keeping the two sources of truth aligned.

Minor observations (non-blocking):

• The --base main / --target-branch main is hardcoded. If a repo uses a different default branch (e.g., master, develop), the generated command will target the wrong branch. This is a pre-existing design decision and doesn't need to block this PR, but worth noting for a future enhancement.

Summary Table

Priority	Issue
🟢 Green	Hardcoded main as base branch — consider making configurable in the future

Recommendation: Approve — clean, well-tested feature addition with no security or correctness concerns. The PR/MR detection logic is sound, test coverage is comprehensive, and the SKILL.md documentation stays synchronized.