Conflicts, part 2: Finish commits the chosen resolution onto the pull's branch, with no clone and no agent #1967

Split from #1134.

Done looks like:

• [ ] "Finish" on the conflicts page (a same-origin POST, write access only, every choice validated against the blocks) builds the merged tree from merge-tree plus the choices, commits it with commit-tree as the person, and updates the head branch; then the pull re-checks and the person lands back on the pull.
• [ ] A head that moved since the page was drawn is refused with words that say so, and nothing is written.
• [ ] No working tree, no clone, no tokens spent. Test: a resolved two-block conflict leaves the pull mergeable with the expected file; a stale head is refused.
• [ ] docs/PULLS.md says how it works.

Start from today's main, at or after 36daece8. The red 'the release record is newest first' on earlier tries was main's own fault (#1837, fixed in 39e98bc9), not the builder's. A new migration is a file src/core/migrations/<UTC yyyymmddHHMMSS>-<name>.ts (see 20261015230000-a-domain-drill.ts), never a number; do not hand-edit src/core/releases.json. Before pushing run bun x tsc --noEmit, the tests this touches, the schema-migrations and schema-additive tests if you add a migration, and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit, and add any new top-level page to the reserved names in the same commit.