feat(pr): security-hardened review-response run — pr-respond body (U5)

Implements the fix-or-disagree agent loop behind pr-respond: batched
one-run-per-cycle over actionable threads (filtering resolved/outdated/
self/bot), with prompt-injection delimiting of untrusted comment bodies,
viewer-authenticated anti-spoof markers, a pre-push secret scan, fast-
forward-only push (no force-push path) with non-ff abort+re-batch, reply+
resolve, commit-last thread-state persistence with marker+SHA crash
recovery (R15), and an iteration cap on responseRounds (R8). GitHub/git/
agent ops injected; engine stays dashboard-import-free. Adds GraphQL
getPrReviewThreadsDetailed + getViewerLogin to the client. 23 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/engine/src/index.ts

@@ -59,7 +59,29 @@ export {
   type PrMergeCallResult,
   type PrRespondCallInput,
   type PrRespondCallResult,
+  type PrRespondGithubOps,
+  buildRespondCallback,
 } from "./pr-nodes.js";
+export {
+  runPrResponseRun,
+  scanForSecrets,
+  buildPrEntityMarker,
+  parsePrEntityMarker,
+  buildResponseSystemPrompt,
+  buildResponsePrompt,
+  DEFAULT_BOT_DENYLIST,
+  DEFAULT_MAX_RESPONSE_ROUNDS,
+  PR_ENTITY_MARKER_PREFIX,
+  type PrResponseRunDeps,
+  type PrResponseRunStore,
+  type PrResponseRunResult,
+  type PrReviewThread,
+  type PrReviewComment,
+  type PrThreadVerdict,
+  type PrAgentRunResult,
+  type PrPushResult,
+  type SecretFinding,
+} from "./pr-response-run.js";
 export {
   PrReconciler,
   deriveTransitions,