feat(ai): harden writing workflows

[danielss-dev]

Summary

• Add bounded, provenance-aware AI input preparation with sensitive-file detection and explicit confirmation before including protected content.
• Improve prompt construction with change manifests, patch coverage metadata, style context, and trust-boundary instructions.
• Add cancellable generation, safer CLI resolution and execution limits, and shared provider handling for Codex and Claude.
• Update pull request creation and local-change flows to surface coverage, cancellation, and provider errors more clearly.
• Document the updated AI and pull request workflows and add generation-related test coverage.

Why

Make AI-generated commit messages and pull request drafts safer, more complete, and more predictable when handling sensitive files, large diffs, untrusted repository content, and long-running provider commands.