Require git proof before prune deletes a branch

A merged or closed PR no longer authorises a delete on its own: HEAD must
be contained in the PR's head commit or in origin/<branch>, otherwise the
worktree goes and the branch stays. Branch deletion runs `git branch -d`
first and falls back to -D only for a proven branch.

Reword the cherry check to say patches reached the default branch's
history, print the verdict --keep-branches will actually perform, and warn
when a PR listing hits the pagination cap instead of reading it as "no PR".

AGENTS.md

@@ -192,6 +192,8 @@ wrapped per stage (login / read denied / write denied) via `ErrVaultDenied`.
   is deleted, which merging does, so `head.ref` matching misses every merged PR.
   Git signals (`merge-base --is-ancestor`, `git cherry`) are authoritative and
   offline-safe; an unreachable Gitea only means no branch gets deleted without
-  git proof.
+  git proof. A PR's state never authorises a branch delete on its own — HEAD
+  must be contained in the PR's head commit or in `origin/<branch>`, otherwise
+  the worktree goes and the branch stays.
 - CI "combined status" comes from `/commits/{sha}/status`; an empty head SHA
   yields an empty state without an API call.