CI guard to block out-of-order stacked PR merges

[ed-irl-codebot]

Problem

Nothing stops a stacked PR from being merged before its downstack
dependencies have landed. Merging mid-stack out of order corrupts the
stack: the merged PR pulls in commits from branches below it that were
never reviewed or merged on their own, and the remaining PRs retarget
against an unexpected base.

Proposal

Add gs ci merge-guard <number>, a CI/CD subcommand intended to run in
forge pipelines. It fails when a PR's base branch is not trunk, i.e.
when the PR still has unmerged downstack dependencies.

Behavior:

• By default only git-spice managed PRs are checked; unmanaged PRs pass
  through. --all blocks any PR whose base is not trunk.
• Trunk is auto-detected from a gs:trunk metadata marker embedded in
  the navigation comment, so the command needs no local state and can
  run against any PR number in CI. --trunk overrides detection.
• Exits 0 when safe to merge, non-zero with a descriptive error
  otherwise.

Note: the trunk marker overloads the navigation comment to carry
metadata, which is more load-bearing than before — open to alternative
mechanisms for tracking trunk across forges.

Tracked by

• feat: add 'gs ci merge-guard' to block out-of-order stacked PR merges #1153 — gs ci merge-guard command