The terminal's pull screen holds a pull with `h` and a reason, and lets it go with `h` again, as MCP `hold` does #7257

For: the owner who sees a pull about to land that should wait, while in the terminal. Steering means stopping one pull is one key, not a browser trip.

holdPull and releasePull (src/actions/holds.ts) are reached from the pull page and MCP hold. The terminal's pull screen (src/tui/screens/pull.ts) has no key for them; h is free there.

Done:

• [ ] On an open pull, h asks for a reason (one line, may be empty) and holds it through holdPull; the header then shows "held" with who and why.
• [ ] On a held pull, h lets it go after a confirm, through releasePull.
• [ ] Only a person who can write is offered h; an agent or a reader is not, and the action's refusal words are shown if it refuses anyway.
• [ ] A test in test/tui-pull*.test.ts or a new one: hold with a reason, the header says held, release clears it; an agent session has no h.

Files: src/tui/screens/pull.ts, one test. Risk: low.