feat: add local-first pr builder

[steezkelly]

Summary

Implements issue #54 step 4: local-first PR preparation from evolution run reports.

Adds:

• evolution/core/pr_builder.py
• deterministic build_pr_title(report)
• deterministic build_pr_body(report)
• prepare_pr(...) with remote mutation off by default
• CLI: python -m evolution.core.pr_builder --report <report.json> --dry-run
• tests proving default behavior does not run push/open commands

The generated PR body includes:

• summary
• before/after metrics
• dataset/model metadata
• artifact hashes and paths
• constraint results
• benchmark gate result if present
• risk notes
• rollback command
• test plan

Safety / mutation behavior

Default behavior is local-only and dry-run:

python -m evolution.core.pr_builder --report reports/runs/example.json --dry-run

Remote mutation requires explicit flags and --execute:

python -m evolution.core.pr_builder --report reports/runs/example.json --execute --push --open-pr

No push or GitHub PR creation occurs unless those explicit flags are set.

Test Plan

• RED first: pytest tests/core/test_pr_builder.py -q failed because evolution.core.pr_builder did not exist
• pytest tests/core/test_pr_builder.py -q
• pytest -q
• runtime probe for CLI dry-run output
• static added-line security scan
• git diff --check

Result: 144 passed, 11 warnings (DSPy deprecation warnings only).

Partially addresses #54.

[steezkelly]

Closing this split PR in favor of consolidated PR #67. Local integration found review/merge overhead across the stack (notably #61/#64 overlap in evolution/skills/evolve_skill.py), and #67 preserves the combined local test evidence: targeted stack tests 21 passed; full suite 160 passed; GitHub checks were absent on the split PRs. Review #67 instead.