Add quick action buttons to session detail header

[dhilgaertner]

Summary

• Adds PR-status-aware quick action buttons to the session detail header so users can act on a session card without switching into it and typing a prompt by hand.
• Each button maps 1:1 to an existing status badge: Rebase & Fix Conflicts (conflicts), Address Review (changes requested), Fix Checks (failing CI), Merge PR (ready to merge).
• Click → routes through a new dispatchManual on AutoRespondCoordinator → injects a deterministic single-line prompt into the session's managed Claude Code terminal via TerminalManager.shared.send.
• The addressChanges and fixChecks prompts share text with the existing auto-respond pipeline (AutoRespondPrompts) so manual and auto paths stay consistent. New prompts added for fixConflicts and mergePR, including GitLab variants.
• Buttons hide when the PR is merged or no status is known, and disable (with a tooltip) when the session has no managed terminal.

Test plan

• make build passes
• make test passes (CrowCore + Tests/)
• Open a session whose PR has merge conflicts → Rebase button appears, click types the rebase prompt into the terminal
• Open a session with changes requested → Address Review button appears
• Open a session with failing checks → Fix Checks button appears
• Open a session that is ready to merge (passing + approved + mergeable) → Merge PR button appears as the prominent green action
• Open a session whose PR is merged → no quick action buttons render
• Open a session with no managed terminal → buttons render disabled with tooltip
• Existing detail header buttons (Open VS Code, Open Terminal, In Review, Mark Completed, Delete) are unchanged

Closes #230

🤖 Generated with Claude Code

[dgershman]

Code & Security Review

Critical Issues

None found.

Security Review

Strengths:

• Prompts are deterministic string templates — no user-controlled input is interpolated unsafely into shell commands.
• parsePRNumber(from:) safely parses via Int(last), which returns nil for non-numeric input rather than crashing or allowing injection.
• The --force-with-lease flag in the rebase prompt is the correct safe alternative to --force.
• dispatchManual re-validates terminal state (managed terminal exists, surface initialized, PR link present) before sending, rather than trusting the UI's canDispatchQuickAction gate alone. Defense in depth.

Concerns:

• None material. The prompt text is sent to a local terminal, not an external API, so the blast radius of any prompt content issue is limited to the local Claude Code session.

Code Quality

Well done:

• Clean separation: QuickAction enum in CrowCore (view layer), QuickActionPrompts in the app layer alongside AutoRespondPrompts. The model doesn't depend on prompt-building logic.
• addressChanges and fixChecks correctly delegate to AutoRespondPrompts.build via synthetic PRStatusTransition values — single source of truth for prompt text.
• The @ViewBuilder pattern in quickActionButtons is idiomatic SwiftUI. Conditional rendering based on PRStatus fields (mergeable, reviewStatus, checksPass, isReadyToMerge) is clean and maps directly to the existing status badges.
• Disabled state + tooltip for sessions without a managed terminal is good UX.
• AutoRespondCoordinator is @MainActor, and the onQuickAction closure is called from SwiftUI button actions (main thread), so thread safety is correct.

Minor observations (non-blocking):

1. Session.provider is optional (Provider?) — dispatchManual defaults to .github via ?? .github when nil. This matches the existing dispatch(_:) pattern at line 56, so it's consistent, but worth noting that a session with no explicit provider will silently get GitHub-flavored prompts.
2. Synthetic PRStatusTransition uses UUID() for sessionID — this is fine since AutoRespondPrompts.build never reads sessionID, but it's a slight code smell. A static sentinel UUID or making sessionID non-required for prompt building would be cleaner, though not worth the refactor now.
3. Multiple quick action buttons can show simultaneously (e.g., conflicts + failing checks). This seems intentional and correct — a PR can have multiple issues at once.

Summary Table

Priority	Issue
🟢	Synthetic UUID() in QuickActionPrompts — cosmetic, matches existing pattern
🟢	provider ?? .github fallback — consistent with existing code

Recommendation: Approve — clean feature addition that correctly extends the existing auto-respond architecture with a manual dispatch path. Good separation of concerns, proper guard chains, and consistent prompt reuse. All 136 CrowCore tests pass.