🐛 Add CHANGES_REQUESTED pre-merge guard to pr-review prompt

[monkut]

Summary

Closes #86.

The pr-review agent has been merging PRs that had unresolved CHANGES_REQUESTED reviews (see weyucou/ellen-core#118). The agent has Bash(gh:*,git:*) access and the prompt never instructed it to check review state before any merge action.

This change adds a Pre-merge guard (CHANGES_REQUESTED) block to REVIEWPR_AGENT_PROMPT in askcc/definitions.py that:

• Requires running gh pr view <number> -R <owner/repo> --json reviews --jq '[.reviews[] | select(.state == \"CHANGES_REQUESTED\")]' before merging.
• If any results return, the agent MUST NOT merge; instead address the changes, reply to all inline comments, push a fix commit, and re-request review.

Key Flows

```mermaid
flowchart TD
A[pr-review starts] --> B[Pre-review: read diff, run tests]
B --> C[Pre-merge guard: gh pr view --jq CHANGES_REQUESTED]
C -->|none| D[Definition of Done checklist]
C -->|any| E[Address changes + reply inline + push fix + re-request review]
E --> F[Stop, do NOT merge]
D --> G[Post review via gh pr review]
```

Verification

• `uv run poe test` — passed (186 tests)
• `uv run poe check` — passed (ruff, no issues)
• `uv run poe typecheck` — passed (pyright, 0 errors)

Followed red/green TDD: 4 new tests in `TestReviewprPromptMergeGuard` were added first and confirmed failing, then the prompt was updated to make them pass.

Test plan

• On a PR with an open CHANGES_REQUESTED review, run `askcc pr-review -g ` and confirm the agent does NOT merge — instead addresses comments and pushes a fix.
• On a PR with no CHANGES_REQUESTED reviews, confirm the agent still posts an APPROVE review as before.