Add real GitHub PR/CI gates to supervisor with explicit merge policy

[dapi]

Problem

The supervisor roadmap promises a reviewed, mergeable PR with green CI and optional merge, but the current zelma supervisor start-issue help states that it does not merge GitHub PRs and existing E2E coverage simulates the final merge. This is an intentional safety boundary, but also a visible product gap.

Desired outcome

Add real, read-first GitHub PR/review/check inspection to supervisor, followed by a separately gated merge path only when an explicit policy allows it.

Scope

• Resolve the PR created for the supervised issue/branch and inspect draft state, review decision, mergeability and required checks.
• Feed actionable failed-check/review context back to the supervised agent through the existing safe session-send path.
• Expose a structured terminal result and audit-friendly reason codes.
• Require an explicit merge policy/flag before any merge attempt; respect branch protection and never bypass required approval or CI.
• Cover no-PR, pending, failed, cancelled, blocked and successful-check cases.

Acceptance criteria

• Supervisor never reports success while required review/CI gates are unsatisfied.
• Default behaviour remains non-merging and read-only with respect to GitHub merge state.
• Any merge attempt requires explicit user/project policy and surfaces the exact gate evidence.
• Integration tests use fake GitHub boundaries; optional live smoke verification is separately documented.

Non-goals

• No branch-protection bypass.
• No auto-merge by default.
• No unrelated PR triage.