upstream: adopt the pull-request hub and its unblocked follow-ups

[rynfar]

Continues the 2026-09-03 upstream adoption after #260 and #261. Five commits:
#9188 plus the four it unblocked once it landed.

What is here

• #9188 fix(pull-requests): missing features & better behaviour — the hub.
  Two small conflicts: upstream widens a check status to treat
  action-required as pending, and both sides add a SidebarChrome import.
  It also widens GitHubViewerAccess with canTriage, so four Pylon-only mock
  sites in GitHubPullRequestProvider.test.ts needed the new field.
• #9334 collapse PR header actions to icons when narrow — applied clean
  once its parent landed. It had been parked as chained.
• #9184, #9280, #9294 — also clean once #9188 was in.

Verification

• typecheck clean across web, desktop, server, contracts, client-runtime
• 1307 tests across the touched pull-request and chat suites
• 40 desktop window tests
• formatter clean

Not here

Four commits are parked with specific blockers rather than guessed at:

• #9141 hold-to-quit and #7254 browser profiles both need
  QuitConfirmationMode, which upstream added in #9076 — a commit that sits
  before the review cursor and that Pylon never adopted. Pylon's
  confirmQuit is still Schema.Boolean where upstream's is a mode enum.
  Adopting #9076 is outside the approved batch and wants a decision.
• #9253 media unification and #7855 resting composer are
  architectural adoptions rather than conflicts, like #9106 in Adopt #9106 tool group summaries: mobile work-log needs an architectural merge #263.

Made with Opus 5 in Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.6 KiB	−7 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.5 KiB	−9 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.5 KiB	56.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.7 KiB	13.7 KiB	−82 B (−0.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+11 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.6 KiB	−93 B (−1.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.1 KiB	57.3 KiB	−840 B (−1.4%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: f839aea · PR result: d242fbe · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.