standing PR: neutralise CI-skip markers in the PR body so a squash merge can't skip the publish #776

This was generated by AI during triage.

Found while reviewing #729.

Agent Brief

Category: bug
Summary: Neutralise CI-skip markers in the standing PR body so a squash merge can't carry one onto main and skip the publish.

Current behavior:
With GitHub's squash commit message set to "Pull request title and description" (squash_merge_commit_message=PR_BODY), the standing PR's body becomes the body of the squash commit on main. GitHub skips push-triggered workflows when that commit's message contains a CI-skip marker such as [skip ci], [ci skip], [no ci], [skip actions] or [actions skip]. The body includes text releasekit doesn't control:

• changelog entries built from feeder commit subjects, such as fix: typo [skip ci];
• LLM-written notes;
• human edits in the notes region.

None of these has markers neutralised (only @-mentions are), so a single marker anywhere in the body suppresses the publish workflow after the merge. Releasekit's own repo and the default squash setting aren't affected: a one-commit PR squashes with that commit's message, and #729 guards its subject.

Desired behavior:

• Every standing-PR body releasekit writes contains no CI-skip marker verbatim, in any of the forms GitHub recognises, case-insensitively.
• The neutralised text still reads naturally on the rendered PR page, for example by breaking the token with a zero-width character. The result must not show as escape-sequence noise in the rendered body.
• Human edits in the notes region are neutralised when the body is re-rendered, and the round-trip stays stable: re-rendering an already-neutralised body changes nothing.
• The marker pattern is shared with fix(release): commit the standing PR's release branch with the PR title #729's title check, not duplicated.

Key interfaces:

• The standing-PR body composer, the single point before the body is upserted.
• The existing output sanitisation for marker comments (<!-- releasekit-* --> neutralisation from LLM notes security pack: neutralize releasekit marker sequences in LLM/edited output; harden prompts against injection #540) is the closest precedent and may be the right home.

Acceptance criteria:

• A standing-PR update whose changelog includes a feeder commit subject with each marker form produces a body containing none of them verbatim (unit test through runStandingPRUpdate with the fake forge).
• The same holds for LLM-written notes and a human-edited notes region.
• Re-rendering a neutralised body is a no-op.
• The rendered text still shows the original words.

Out of scope:

• The PR title and release commit subject (fix(release): commit the standing PR's release branch with the PR title #729).
• GitHub Release bodies and changelog files, which don't trigger workflows.