Approve/merge enumerate the session's PRs by feature branch; gitignore inventory snapshots

[silug]

Combined change per the workflow discussion: make the harvest plans self-contained, and demote the dynamic-inventory snapshot to an informational artifact.

Approve/merge: the PRs are the ground truth

puppetsync::approve_github_prs and ::merge_github_prs no longer consume a repo inventory. They enumerate the session's open PRs directly from the GitHub API — search by org + head branch (git.feature_branch) + author (github.pr_user), then hydrate each PR's base ref — via the new list_github_prs task and repo_targets_from_prs function (each target's branch comes from its PR's base, not from any list).

Why this beats any inventory:

• Exact alignment with reality: a repo that failed before the PR stage has no PR (a snapshot would include it → approval noise); a repo added to the org after the sync has no PR (regenerating inventory at harvest time would include it → failure noise).
• Zero handoff state: any approver, any machine, any time — the session config alone suffices. This makes the bare bolt plan run puppetsync::approve_github_prs invocation (config via the latest symlink) fully self-contained, which is exactly the shape scheduled runs (Scheduled org-wide puppetsync runs (continuous baseline enforcement) #56) need.
• github.org is a new optional config key (default simp).

Live-verified against the real session: list_github_prs enumerated exactly the 71 open PRs from the 20260731-release-rpms-ghcr run — the two unchanged repos correctly absent, all base refs hydrated.

Snapshot demoted to informational

data/sync/repolists/generated-*.yaml is now gitignored; the sync's completion message, github-org.yaml, and the README no longer direct operators to hand it to approve/merge. (The generated-latest.yaml naming from symlink-driven runs made it a poor artifact of record anyway.) repos_config remains a parameter on both plans for CLI compatibility, documented as deprecated/unused.

Testing

• BoltSpec approve/merge suites rewritten for the new flow: enumeration params asserted (org/branch/author), per-PR task params including base-ref propagation, failure summarization, no-open-PRs fail-fast, and stage-list opt-out. 17 plan examples, 0 failures.
• New list_github_prs subprocess spec (injection-based, matching the list_github_repos pattern); 199 plain examples, 0 failures; idempotency e2e green.
• puppet parser validate --tasks, bolt plan show for both plans, and the stage-list dry run all green.

Suggested test-for-real

Merge this, rebase #80 on top, then harvest the live session with the new flow: bolt plan run puppetsync::approve_github_prs / ::merge_github_prs with no repolist argument at all.

🤖 Generated with Claude Code