feat(cloud-agent): refine cloud PR publish policy

[tatoalo]

Problem

cloud runs PR behavior needed to be more predictable across origins and session states

We want:

• Slack-origin coding tasks to auto-create or auto-update PRs by default
• non-Slack cloud runs to stop for review unless the user explicitly asks to publish
• exploratory runs with createPr=false to reliably avoid publishing
• detected existing PRs in a live session to follow the same policy as the startup prompt