Require git proof before prune deletes a branch

A merged or closed PR no longer authorises a delete on its own: HEAD must
be contained in the PR's head commit or in origin/<branch>, otherwise the
worktree goes and the branch stays. Branch deletion runs `git branch -d`
first and falls back to -D only for a proven branch.

Reword the cherry check to say patches reached the default branch's
history, print the verdict --keep-branches will actually perform, and warn
when a PR listing hits the pagination cap instead of reading it as "no PR".

internal/agent/gitea.go

@@ -150,8 +150,13 @@ const (
 	maxPRPages = 20
 )
 
+// ErrPRListTruncated reports that a listing hit the page cap, so the returned
+// pull requests are only the most recent ones and older PRs went unseen.
+var ErrPRListTruncated = errors.New("pull request listing truncated at the page cap")
+
 // ListPRs lists a repo's pull requests in the given state ("open", "closed" or
-// "all"), following pagination.
+// "all"), following pagination. A repo with more PRs than the page cap returns
+// the PRs it did read alongside ErrPRListTruncated.
 func (c *GiteaClient) ListPRs(repoPath, state string) ([]PullRequest, error) {
 	if state == "" {
 		state = "all"
@@ -165,10 +170,10 @@ func (c *GiteaClient) ListPRs(repoPath, state string) ([]PullRequest, error) {
 		}
 		all = append(all, batch...)
 		if len(batch) < prPageSize {
-			break
+			return all, nil
 		}
 	}
-	return all, nil
+	return all, fmt.Errorf("%s: %w after %d pull requests", repoPath, ErrPRListTruncated, len(all))
 }
 
 // PRHeadBranch returns the branch a PR was opened from. Gitea rewrites head.ref