fix: solve #4513 — wrong PR shown next to V2 sidebar workspaces

[github-actions]

Root cause

V2's PR resolution in packages/host-service/src/runtime/pull-requests/ had two gaps relative to V1:

1. normalizePullRequestCandidates used .find against the REST pulls?head=...&state=all response (sorted by updated desc). A recently-closed PR could be picked over an older open PR on the same head.
2. performProjectRefresh attached any matched PR unconditionally. V1 has shouldAcceptPRMatch — historical (CLOSED/MERGED) PRs only attach when headRefOid === workspace.headSha. V2 had no counterpart, so a long-closed PR on master kept reappearing after the branch HEAD had moved on.

Fix

• github-query.ts: sort candidates by state rank (OPEN > MERGED > CLOSED), tiebreak on updatedAt desc. This fixes the "multiple PRs, closed wins" case.
• pull-requests.ts: introduce shouldAttachHistoricalMatch and gate the per-workspace link assignment. CLOSED/MERGED matches only attach when their headSha equals workspace.headSha. Surface state + headSha from fetchRepoPullRequests so the per-workspace decision has the data.

Mirrors the V1 logic in apps/desktop/src/lib/trpc/routers/workspaces/utils/github/pr-resolution.ts (shouldAcceptPRMatch + sortPRCandidates) — which is exactly the spread the issue cites as "not present in V1".

Tests proving repro + resolution

• github-query.test.ts: open PR (new desktop #101, older updatedAt) is selected over closed PR (better persistence #100, newer updatedAt) on the same head.
• pull-requests.test.ts: a stale closed PR on master whose headRefOid differs from workspace.headSha does not attach after refreshPullRequestsByWorkspaces.

Both tests fail on main and pass with this patch.

Test plan

• bun test packages/host-service/src/runtime/pull-requests/ — 12 pass, 0 fail
• bun run lint — clean
• tsc --noEmit for host-service — clean
• Manual: open the V2 sidebar in a workspace whose branch has a historical closed PR; confirm no PR badge appears.
• Manual: branch with both a closed and an open PR shows the open one.

Closes #4513

---

Summary by cubic

Fixes the wrong PR showing next to V2 sidebar workspaces by preferring open PRs and preventing stale closed/merged PRs from attaching after the branch moves. Closes #4513.

• Bug Fixes
  • Sort head candidates by state (OPEN > MERGED > CLOSED), then updatedAt desc, in github-query.ts.
  • Gate linking with shouldAttachHistoricalMatch: CLOSED/MERGED only attach when PR headSha equals workspace.headSha.
  • Surface state and headSha through the fetch for linking decisions; added targeted tests for both scenarios.

^{Written for commit 3ce2dbb. Summary will update on new commits.}

[jnelken]

would love to see this merged 🙏🏼