fix(tasks): keep draft PRs from proving the review stage

[64ix]

Description

An open PR used to hold its task in Review as soon as it referenced the Spec (or was assigned to the task), even while it was still a GitHub draft. A draft is not ready for review, so the board now waits for the ready-for-review flip before deriving the stage:

• PrWorkflowFact carries isDraft (loaded from pull_requests.is_draft), and derivePrStage only accepts review from a ready (non-draft) open PR.
• An assigned open draft derives nothing; the same Spec-derived fallback syncProject already performs decides instead, so the Task Detail Panel and the periodic pass can never diverge on a draft assignment.
• The holding PR picked for display satisfies the exact predicate the stage was proven with — a draft is never presented as the fact holding the task in Review.
• getStageAuthority now always loads PR facts + the Spec link (instead of short-circuiting on an assignment) — that early return was safe while an assignment always derived a stage; the draft rule makes the fallback reachable, so the panel must see the same facts.

Unchanged by design:

• Merged/closed drafts still prove shipped/triage (a merged PR is no longer a draft anyway; closing one unmerged still triages the task).
• A task already in Review is not downgraded when its PR is converted back to draft — the sync never regresses without a stronger fact.

Related issues

None on the tracker yet — captured from maintainer feedback ("quand la PR est en draft, ne la passe pas en review").

Testing

Local merge gate, all green on this branch's base:

• pnpm run format, pnpm exec oxlint ., pnpm typecheck
• vitest run --project node --project main-db --project migrations --project scripts: 387 files / 3459 tests passed
  • New unit tests in pr-workflow-derivation.test.ts: draft alone proves nothing; draft + merged → shipped; draft + ready → ready picked as holding PR; assigned draft falls back to Spec-derived / proves nothing link-less.
  • New DB tests in board-sync-service.db.test.ts: the sync pass leaves a task in implementing (and emits no stage event) while its Spec-referencing PR is an open draft; moves it to review once marked ready; an assigned draft leaves the task untouched.
• Browser (Playwright) and Docker-SSH suites: not-run (infra absent).

Checklist

• I kept this PR small and focused
• I ran a self-review before opening this PR
• I ran the relevant local checks or explained why not
• I updated docs when behavior or setup changed — behavior documented in-code where the rule lives; no setup change
• I added or updated tests when behavior changed, or explained why not
• I only added comments where the logic is not obvious
• I used Conventional Commits for commit messages and, when possible, the PR title