fix: prove reused integration branches

[coygeek]

Summary

• build every integration candidate on a unique staging ref so concurrent coordinators never mutate the same branch
• seal the exact frozen membership, base, merged heads, and conflict state into an immutable commit
• atomically publish the deterministic integration ref and safely reuse a concurrent winner
• recover sealed branches after PR-creation failures, newer-main advancement, closed PRs, and partial source-label cleanup
• preserve overlap-mode subsets, duplicate source heads, draft/ready transitions, and current receipt/identity behavior
• fail closed on unsealed, malformed, mismatched, or ancestry-invalid integration refs

This replaces the earlier force-reset approach with immutable staging and seal ownership, avoiding branch-clobber races while retaining retry recovery.

Closes #19

Verification

• Full pytest suite: 241 passed, 3 skipped, 202 subtests
• Ruff: clean
• Structured Codex autoreview: clean after all accepted findings were fixed

[mberman84]

Requesting changes for a reused-PR state transition bug, plus a required rebase. This head conflicts with current main; after preserving main's tests, two existing integration tests also need their mocked API sequences updated for the new ancestry calls. Please rebase, keep all current integration coverage, convert reused PRs back to draft when replay introduces a conflict, and add the reverse ready-to-draft regression. GitHub CI is still action_required; re-request review on the updated head.

[mberman84]

This handles only draft-to-ready. If resetting a reused integration branch onto a newer base introduces a conflict, an existing non-draft PR remains marked ready even though the marker describes a partial batch. Convert the reused PR back to draft whenever conflict is non-null before publishing the new marker, and add a ready-to-draft replay test.

[coygeek]

Addressed the review feedback in the updated head. Reused integration PRs now convert back to draft with gh pr ready --undo if replaying onto the reset branch hits a conflict, so an existing ready PR cannot keep presenting a partial batch as mergeable. Added regression coverage for that redraft path while preserving the existing orphan-branch cleanup and reused-branch tests.

Verification: PYTHONPATH=src uv run --with pytest --with ruff python -m pytest tests/test_cli.py -q and uv run --with ruff ruff check src tests both pass.

[mberman84]

Re-reviewed after a full semantic rebase and concurrency redesign. Integration candidates are now staged uniquely, immutably sealed, atomically published, and safely recoverable without shared-branch resets. Full suite: 241 passed, 3 skipped, 202 subtests; Ruff clean; final structured autoreview clean.