feat(boatstack): post-publish prescriptions — the frontier extends to merged

[bigboateng]

Fifth slice of the published → merged program (stacked on #239) — the one that retires the standing "watch CI and merge" prompt. With delivery.terminal: merged, flow next now answers "what now?" all the way to the merge, and every answer is actor-typed.

What changed

Prescriptions, derived from the live PR observation only (never from claims):

Observed phase	Prescribed	Actor
PR_CHECKS_PENDING	boatstack-helper flow watch	agent
PR_CHECKS_FAILING	record-change --source-stage ci (+ owed --message --classification from the failing check logs; failing names ride along in the follow-up)	agent
PR_MERGE_ELIGIBLE	gh pr merge <url> --squash	agent, prescribe-only
PR_REVIEW_REQUIRED, PR_CHANGES_REQUESTED, PR_CLOSED, PR_UNKNOWN	nothing	operator
merged	nothing	none

• The fix path is the existing delivery.record_change registry transition — no new machinery; corrections flow through record-change → gates → publish-pr --action update as they already do for published-open slices.
• New non-registry markers published.watch_checks / published.merge (provenance; never allowlistable), following the planning.* pattern.
• PrescribedCommand.Program names the one honestly-foreign command; CommandLine() renders it. Triple containment for the merge: canAutoDrive refuses Program != "" categorically before consulting the allowlist; the transition is a marker; executePrescribed has no executor. Boatstack cannot merge — the agent runs gh under the host's own permissions, only as rendered.
• classifyNextActor: the PUBLISHED branch is now phase+terminal dependent; fail-closed — the zero Terminal behaves as published, and every underivable phase stays the operator's.
• Response contract: the new agent steps render through the existing "This step is mine to do. Reply g" delegation — one rendering path, no drift.
• SKILL.md + references/workflow.md: post-publish protocol (PR_OPEN -> MERGED section); the "never merged" completion sentence now carries the explicit merged-terminal exception.

Boundary conformance

• Boundary: prescription authority extending past publish toward an external actuator (gh).
• Control laws: merged-terminal-prescribes-merge-never-executes-it; turn-ends-only-at-the-operator-frontier (extension).
• Required evidence: post_publish_prescribe_conformance_test.go — positive (per-phase prescription + actor through real ResolveNext; delegation line renders with the exact merge command), negative (operator phases prescribe nothing; published default byte-behavior preserved), bypass (drive decision is prescribe-and-stop; canAutoDrive refuses even a hostile allowlist naming published.merge), failure-state (unknown phase → operator; merged → none).
• Failure behavior: fail-closed to operator everywhere; no prescription is ever fabricated from an unverifiable position.
• Release condition: full suite green; zero registry rows; the auto-drive allowlist remains empty.

Evidence

• go build ./... && go vet ./... && go test ./... — pass.
• Release note added: 2026-07-28-post-publish-prescriptions.md.

Next slices: bounded pursuit (escape conditions), then the offline retro miner.