feat: manual PR fallback and branch-aligned create-pr flow

[ColeMurray]

Summary

This PR consolidates manual PR fallback and branch-alignment improvements for create-pr.

Key outcomes:

• create-pr accepts optional headBranch and resolves branch deterministically
• sandbox push uses provider-generated pushSpec so pushed branch and PR branch stay aligned
• control-plane falls back to provider-built GitHub pull/new URL when user OAuth is unavailable
• Slack completion shows a Create PR button from manual branch artifacts with stricter metadata handling

Validation

• npm run build -w @open-inspect/shared
• npm run typecheck
• npm run test -w @open-inspect/control-plane
• npm run test -w @open-inspect/slack-bot -- run

[github-actions]

Terraform Validation Results

Step	Status
Format	⚠️
Init	✅
Validate	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request

[greptile-apps]

Greptile Overview

Greptile Summary

• Consolidates production changes for manual PR fallback and branch-aligned create-pr into the public codebase.
• Introduces deterministic branch resolution via optional headBranch and provider-generated pushSpec so the pushed branch matches the PR head.
• Adds control-plane fallback behavior to build manual GitHub pull/new URLs when user OAuth isn’t available.
• Updates Slack completion flow to surface a “Create PR” button from manual branch artifacts with stricter metadata handling.
• Expands/updates tests around branch resolution, GitHub provider behavior, and Slack completion extraction/rendering.

[greptile-apps]

_{3 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Additional Comments (1)

packages/control-plane/src/session/durable-object.ts
Always force-pushing branches

handleCreatePR builds the pushSpec with force: true, which will overwrite the remote branch if it already exists. This can destroy work if someone reused the same headBranch (especially now that headBranch can come from the client’s current branch). Unless you require force pushes for this flow, this should be false (or conditional only for the generated session branch).

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/control-plane/src/session/durable-object.ts
Line: 2363:2373

Comment:
**Always force-pushing branches**

`handleCreatePR` builds the `pushSpec` with `force: true`, which will overwrite the remote branch if it already exists. This can destroy work if someone reused the same `headBranch` (especially now that `headBranch` can come from the client’s current branch). Unless you *require* force pushes for this flow, this should be `false` (or conditional only for the generated session branch).

How can I resolve this? If you propose a fix, please make it concise.

[github-actions]

Terraform Validation Results

Step	Status
Format	⚠️
Init	✅
Validate	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request