PR detection accepts any same-repo `/pull/N` URL in agent output, even when no PR was opened

[genisd]

Description

an u;r like this in the prompt https://github.com/acme/pull/5678 will get parsed as pr opened, while no pr was opened.

Steps to Reproduce

1. Create a Repo Task whose prompt template, task file, or any tool output
   contains a literal example URL on the task's own repo, e.g.

   Capture the PR URL from the output (e.g., https://github.com/acme/web/pull/5678).

2. Run the task. Have the agent Read the task file (or otherwise emit the URL
   in any text / tool_result entry that is not a JSON array containing
   "number").

3. Have the agent exit successfully without running gh pr create/git push.

Observed: task transitions to pr_opened, tasks.prUrl set to
https://github.com/acme/pull/5678. PR #5678 may not exist at all, or may
be an unrelated PR by another user.

Expected Behavior

Expected: task transitions to needs_attention with reason
completed_without_pr.

maybe this is too difficult. alternatively we could reject such a prompt and warn the operator about this issue

[genisd]

so the issue here is that if one adds a pr url to the prompt it immediately gets detected as a PR opened.

perhaps we should reject such a prompt in the frontend and inform the operator that it would break the PR detection