feat: add bounded codex unread triage

scripts/src/commander.ts

@@ -144,6 +144,63 @@ function issueEntryPlan(): Record<string, unknown> {
   };
 }
 
+function prCloseoutPlan(): Record<string, unknown> {
+  return {
+    mutation: false,
+    purpose: "PR closeout checklist for commander sessions and PR-bound GPT-5.5 runners; this plan is read-only and does not merge or close anything.",
+    runnerBoundary: {
+      mayCreateUpdateComment: true,
+      maySelfCloseOrMergeOrdinaryPrWithinTaskBoundary: true,
+      conditions: [
+        "task explicitly authorizes PR closeout or merge/close",
+        "PR is ordinary UniDesk source work, not production, release/v1, destructive rollback, secret, database, or runtime hot patch",
+        "checks required by the task have passed or unrelated broad failures are documented",
+        "base/head are reviewed and merge/close target matches the task boundary",
+      ],
+      commanderRequiredWhen: [
+        "conflicts or ambiguous ownership",
+        "failed required checks without accepted explanation",
+        "production/runtime/release/security/database scope",
+        "user or commander explicitly reserves final action",
+      ],
+    },
+    readOnlyChecklist: [
+      {
+        actor: "runner-or-host",
+        command: "bun scripts/cli.ts gh pr view <number> --repo pikasTech/unidesk --json body,title,state,stateDetail,head,base,headRefName,baseRefName,mergeable,mergeStateStatus,statusCheckRollup",
+        mutation: false,
+      },
+      {
+        actor: "runner-or-host",
+        command: "bun scripts/cli.ts gh pr files <number> --repo pikasTech/unidesk --limit 30",
+        mutation: false,
+      },
+      {
+        actor: "runner-or-host",
+        command: "comment or hand off changed files, validation, residual risks, and read-only mergeability/status evidence",
+        mutation: false,
+      },
+    ],
+    finalAction: {
+      ordinaryRunnerAllowed: true,
+      hostCommanderAllowedAfterReview: true,
+      tools: [
+        "system gh pr merge <number> --repo pikasTech/unidesk",
+        "GitHub UI merge/close controls",
+        "bun scripts/cli.ts gh pr close <number> --repo pikasTech/unidesk",
+      ],
+      sourceMergeClosePolicy: "Use repo-owned, auditable GitHub paths; do not directly push target branches as a merge substitute.",
+    },
+    unideskCliBoundary: {
+      mergeSupported: false,
+      closeSupported: true,
+      command: "bun scripts/cli.ts gh pr merge <number> --repo pikasTech/unidesk",
+      degradedReason: "unsupported-command",
+      automatedMergeImplemented: false,
+    },
+  };
+}
+
 function traceSummaryPlan(): Record<string, unknown> {
   return {
     mutation: false,
@@ -203,6 +260,7 @@ function commanderPlan(args: string[]): Record<string, unknown> {
     promptGuidance: promptGuidancePlan(),
     traceSummary: traceSummaryPlan(),
     issueEntries: issueEntryPlan(),
+    prCloseout: prCloseoutPlan(),
     claudeqqApproval: {
       mutation: false,
       commandShape: "bun scripts/cli.ts commander approval request --action <action> --dry-run",