S64: orchestrate mergeable_state — PR create + check completion triggers

[espadonne]

Summary

Wires the three missing triggers from S64 (mergeable_state orchestration), closing audit findings A17/A20.

Pre-existing: the pulls.Mergeability() algorithm was complete; only the kicks that enqueue it were missing outside the HTML review flow. CLI-driven PRs lived stuck on unknown.

Triggers wired in this PR:

1. pulls.Create() — kicks pr:mergeability for the new PR so HTTP/REST + CLI opens leave unknown within the first worker tick (no longer requires a human visiting the HTML review screen).
2. head sync — already wired via PRSynchronize worker chain; no change needed.
3. Check completion — api/checks.UpdateRun and actions/checksync.Job fan out pr:mergeability ticks to every open PR sharing the head SHA, so required-checks gates flip blocked → clean promptly.

Triggers 3 (base-ref pushes) + 4 (branch-protection rule changes) deferred per S64 — they're correctness-improving but lower-impact and 3 is partially covered by trigger 2 already.

Refactor: new internal/pulls/mergeenqueue/ subpackage holds the enqueue helpers (ForPR, ForHeadSHA). Necessary to break the
pulls → actions/trigger → actions/checksync → pulls cycle that direct importing would have created. Existing in-handler kickMergeability (review path) can migrate to it in a follow-up.

Test plan

• TestCreate_EnqueuesMergeabilityJob — pulls.Create leaves a row in the jobs table with kind='pr:mergeability' and the new PR's id
• TestForHeadSHA_EnqueuesPerOpenPR — fan-out enqueues one job per open PR at the given head_oid; PRs at other SHAs skipped
• TestForHeadSHA_EmptyHeadSHA — empty SHA is a no-op (guards against pre-snapshot rows)
• go test ./internal/pulls/... ./internal/actions/checksync/... ./internal/web/handlers/api/... — green
• golangci-lint run ./... — 0 issues
• scripts/lint-unused.sh — clean
• Manual: against shithub.sh, shithub pr create and confirm shithub pr view shows mergeable_state ≠ unknown within seconds; then push CI through and confirm a blocked PR flips to clean once required checks succeed

Closes audit findings A17/A20.

S64 spec lives at shithub/.docs/sprints/S64-mergeable-state-orchestration.md (local).