feat(cli)!: add --direct flag to sync-scaffold, enroll, and unenroll

[fullsend-ai-coder]

sync-scaffold, enroll, and unenroll previously always pushed directly to
the default branch, bypassing branch protection and review. This change
adds a --direct flag to all three commands, making PR-based delivery
the default:

• sync-scaffold defaults to PR delivery (matching setup), with
  --direct to opt into direct push. This command changes 29+ files,
  so review-by-default is appropriate.
• enroll/unenroll also default to PR delivery. When delivered via PR,
  config.yaml is committed to a dedicated fullsend/enrollment-config
  branch (separate from the scaffold's fullsend/scaffold-install branch
  to prevent collision). The repo-maintenance workflow is not dispatched
  in PR mode — it runs automatically when the PR is merged.
• --direct pushes changes to the default branch immediately, falling
  back to a PR if branch protection blocks the push.

Implementation details

• New CommitFilesViaPR export in internal/layers/commit.go provides a
  simpler PR delivery path for same-owner repos (enrollment configs)
  without fork support. The existing CommitScaffoldFiles →
  commitBranchAndPR path retains full fork support for scaffold installs.
• Org variable visibility sync (syncOrgVariableVisibility) is skipped in
  PR mode — it only runs on direct push, since the change hasn't taken
  effect until the PR is merged.

---

Closes #2625

Post-script verification

• Branch is not main/master (agent/2625-pr-delivery-flags)
• Secret scan passed (gitleaks)
• Pre-commit hooks passed
• Tests passed

[github-actions]

E2E tests are running

Authorization passed for this commit. See the E2E Tests workflow for results.

[github-actions]

Site preview

Preview: https://25982ec4-site.fullsend-ai.workers.dev

Commit: 326792a0b06514697e9877da548ba0341585304c

[codecov]

Codecov Report

❌ Patch coverage is 41.77215% with 46 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/layers/commit.go	9.75%	37 Missing ⚠️
internal/cli/admin.go	75.00%	5 Missing and 3 partials ⚠️
internal/cli/github.go	83.33%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[ralphbean]

LGTM. Three notes inline, none blocking.

[rh-hemartin]

@ralphbean this PR is from the coder bot, you probably need to change this yourself

[rh-hemartin]

/fs-fix Why introducing a --pr flag? Just make it the default and then have the --direct alternative.

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 2:07 PM UTC · Completed 2:14 PM UTC
Commit: 2d8adb7 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

Made PR delivery the default for all commands (sync-scaffold, enroll, unenroll) and removed the --pr flag. Only --direct remains as the opt-out. Updated tests to verify --pr no longer exists and --direct is present.

Fixed (1):

1. remove --pr flag, make PR delivery the default: Removed --pr flag from sync-scaffold, enroll, and unenroll commands. PR delivery is now the default for all three commands. The --direct flag remains as the opt-out for direct push. Mutual exclusivity checks removed since there is only one flag now.

Tests: passed

_{Updated by fullsend fix agent}

[waynesun09]

Review Squad — 5 agents (Claude, Gemini, Codex)

3 new findings posted inline (MEDIUM+). 2 findings already covered by existing comments (static PR title at L2630, breaking change at github.go:991) — skipped.

Also: the PR description references a --pr flag and mutual exclusivity that don't exist in the implementation. All three commands default to PR delivery with only --direct as an override. Consider updating the description and title.

[waynesun09]

All review findings addressed: branch collision fixed with dedicated fullsend/enrollment-config branch, variable sync guarded in PR mode, IsForbidden check added to commitViaPR, orphaned StepStart removed. Tests pass, rebased onto main.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 8:00 PM UTC · Completed 8:10 PM UTC
Commit: 326792a · View workflow run →

[fullsend-ai-retro]

Retro: PR #2630 — Add PR delivery flags to sync-scaffold, enroll, unenroll

Timeline

1. Issue sync-scaffold, enroll, and unenroll push directly to default branch instead of creating PRs #2625 filed by waynesun09 requesting PR delivery support for three CLI commands, with differentiated defaults (sync-scaffold→PR, enroll/unenroll→direct).
2. Triage agent reinforced the issue's recommended approach with differentiated defaults.
3. Code agent (commit 386a6d6) faithfully implemented the triage recommendation: both --pr and --direct flags with differentiated defaults per command.
4. ralphbean approved with 3 non-blocking notes: missing feat!: prefix for the breaking default-behavior change, stale godoc, and branch collision risk.
5. rh-hemartin triggered /fs-fix with design feedback: remove --pr, just make PR delivery the default for everything.
6. Fix agent (commit 71c97d8) successfully simplified the API per this feedback.
7. Review squad posted 3 findings: branch collision (HIGH), variable sync in PR mode (MEDIUM), duplicate godoc (MEDIUM). Notably, the squad caught the variable-sync issue that the human reviewer had not flagged.
8. Wayne Sun (human, commit 326792a) fixed all 3 review squad findings manually.
9. PR merged after final human approval.

What went well

• Review squad added real value. It caught 3 legitimate issues, including the variable-sync-in-PR-mode bug that the human reviewer missed. The HIGH-severity branch collision was correctly prioritized.
• Fix agent handled a design pivot cleanly. When rh-hemartin asked to simplify the API (remove --pr, make PR the universal default), the fix agent executed the change correctly and updated tests.
• Triage was thorough. The triage agent provided a well-structured recommendation with differentiated analysis per command.

Gaps observed (all covered by existing issues)

Gap	Existing issue
PR description became stale after fix agent changed the approach	#2418
Review agent didn't flag the missing ! breaking-change suffix on the commit/PR title, despite AGENTS.md explicitly requiring it	#2105 (prefix enforcement) + #2566 (default-behavior change detection)
Review squad findings were fixed by a human rather than auto-dispatching the fix agent	#2596
Code agent's initial commit had 41% patch coverage (vs 80% threshold)	#1719 (run CI before pushing)

Assessment

This was a 3-iteration workflow (code → fix → human fix), which is above average but explainable. The first rework cycle was driven by a human design disagreement with the issue spec — not an agent failure. The code agent faithfully followed the triage recommendation, but a different human preferred a simpler API. The second rework cycle was driven by legitimate review findings that required code changes.

No new proposals are warranted — all identified gaps map to existing open issues. The workflow demonstrates the review squad providing value beyond what human review alone caught.