merge-time check: merge PRs through a script that requires an up-to-date head #450

Operator decision 2026-10-04: no CI, but run the gauntlet on the merged result before a PR merges (option 4 of the merge-time check discussion in the pstack attacker wave; #445 and #446 were each green alone and red together on develop).

Add scripts/merge-pr.sh <PR>:

1. git fetch origin; fail unless the PR head contains the origin/develop tip (git merge-base --is-ancestor). Message: rebase on origin/develop and push; the pre-push gauntlet then runs on the exact tree that will merge.
2. Wait for load below 4 (or fail with the load figure), then merge with gh pr merge --merge --match-head-commit <head-sha> so a push after the check cannot slip in.
3. Print the merge commit sha.

Docs: one short section in docs/reference/branching-model.md and the agent brief convention (docs/reference/spawn-brief.md): agents merge through this script, not bare gh pr merge. State that checks are local-only and the script narrows, not closes, the gap (a push from another clone can still race).
Tests under tests/scripts/ with a stubbed gh/git (up-to-date passes, behind fails, head mismatch fails). No hardcoded home paths; Bash 3.2.