review try-out: open a PR with the classifications on the page

The try-out page gets an "open a PR" button. It posts the page's
classifications to the new POST /api/review-classifier/open-pr, which
merges them by name into the repo's rules file on the default branch
and has the review-classifier forge account commit the result on a new
branch, review-classifier/<user>-<8 hex>, through the contents API. The
commit's author is the forge account named like the session's
Remote-User, read with the controller's admin token. The answer links
to the forge's compare page, where the user opens the PR as themselves.

The push uses the account's existing token from the store
(swarm/services/review-classifier/forge/token, scope write:repository),
so the account needs write access to the repo; a refused push answers
403 naming that. In a YAML rules file, the entries the merge leaves
alone keep their text, as long as the result reads back as the merged
list; otherwise the file is written out whole.

DefaultBranchFiles now carries each file's blob sha, which the forge
needs to replace a file, and the repo's web URL for the link.

Fixes #5259
Refs #5096

swarm-controller/README.md

@@ -62,7 +62,9 @@ The swarm's control plane. The swarm UI and `swarmctl` are its clients.
   requests, and the newest 100 finished runs, one document in the
   `review-classifier-runs` KV bucket, which this daemon alone writes
   (`POST /api/review-classifier/try-out`, `GET /api/review-classifier/try-out/{id}`,
-  `GET /api/review-classifier/rules`, `GET /api/review-classifier/runs`) →
+  `GET /api/review-classifier/rules`, `GET /api/review-classifier/runs`), and
+  the try-out page's branch for a PR, pushed as the classifier's forge account
+  (`POST /api/review-classifier/open-pr`) →
   [`docs/swarm/review-classifier.md`](../docs/swarm/review-classifier.md).
 - **Review classifier settings** — the classifier's runtime, model, effort and how
   many requested reviews run at once, one document in the