feat(pr-ledger): direct-push merges flip PRs to merged; API close endpoint #5508

The Vapron briefing's two Gluecron-side asks, delivered

1. Merged-state auto-detection (GitHub semantics). New src/lib/pr-merge-detect.ts, wired into onPostReceive as fire-and-forget step 3b: on every branch push, any open PR whose head tip is reachable from the new base tip (git merge-base --is-ancestor) flips to merged with mergedAt/mergedBy stamped and an activity-feed entry. Deleted head branches are left untouched (nothing to prove reachability with); git errors fail closed (never flip on a guess); the UPDATE re-asserts state='open' so a concurrent endpoint-merge can't double-flip. This makes the Vapron agent's gate→merge→push flow show up truthfully on the PR page with zero behavior change on their side.

2. POST /api/v2/repos/:owner/:repo/pulls/:number/close. Author or write access; 409 with current state when the PR isn't open; activity-logged. The v2 merge endpoint already exists on current main (shipped Aug 7, performGatedMerge chain) — the box-158 instance predates it and needs a build update to see both. Endpoint index now advertises merge + close.

Tests pin the reachability decisions on a real throwaway repo (merged head, unmerged tip, orphan history, garbage shas → fail closed). 7/7 pass locally; typecheck clean.

🤖 Generated with Claude Code