fix: stop poetry-lock-update from opening duplicate PRs

[blink1073]

References

Description

actions/poetry-lock-update generated a random branch suffix on every run
and unconditionally opened a new PR whenever poetry.lock changed. If a
prior week's update PR was still open when the next scheduled run fired,
this opened a second, competing PR instead of refreshing the first —
duplicate PRs pile up on any repo where the update isn't merged promptly.

This PR makes the action reuse a single, fixed branch and update the
existing open PR in place instead.

Changes

• actions/poetry-lock-update/decide_pr_action.sh (new): given a branch,
  checks for an existing open PR (gh pr list --head "$BRANCH" --state open) and either gh pr edits it (refreshing body + reapplying labels)
  or gh pr creates a new one. A merged or manually-closed PR is not
  "open", so the next run naturally opens a fresh PR — no extra state is
  tracked to remember a rejection.
• actions/poetry-lock-update/test_decide_pr_action.sh (new): tests both
  branches (PR found / not found) and both dry-run variants via a mocked
  gh, wired into .github/workflows/tests.yml's test_scripts job.
• actions/poetry-lock-update/action.yml: drops the random branch suffix,
  force-pushes the fixed ${{ inputs.branch }} branch every run (safe —
  it's exclusively bot-owned and rebuilt fresh from the base each time),
  and delegates the create-vs-update decision to the new script.
• .github/workflows/tests.yml: test_poetry_lock_update job gets a
  pull-requests: read permission override for the new gh pr list read.
• README.md / CLAUDE.md: documented the new behavior, including that
  the branch is force-pushed every run and shouldn't carry manual commits.
• .gitignore: added .worktrees/ (unrelated housekeeping needed to set
  up an isolated workspace for this change).

Backwards-incompatible changes

None. Consumers (e.g. octave_kernel's lock-update.yml) need no input
changes — this is a drop-in behavioral improvement. Note: any pre-existing
randomly-suffixed branches/PRs from before this change are orphaned (not
cleaned up by this PR); the first post-merge run creates the new canonical
poetry-lock-update branch alongside them.

Testing

• bash actions/poetry-lock-update/test_diff_lock.sh and
  bash actions/poetry-lock-update/test_decide_pr_action.sh — both pass
  (18 assertions total)
• just pre-commit --hook-stage=manual (includes actionlint) — all hooks
  pass
• just test — placeholder suite passes
• The "open PR exists → update in place" path is covered by
  test_decide_pr_action.sh's mocked gh, but has no CI fixture
  exercising it against a genuinely open PR end-to-end (deliberately
  creating one in CI would itself produce the exact duplicate-PR noise
  this change removes)

AI usage

• Some or all of the content of this PR was generated by AI.
• The human author has carefully reviewed this PR and run this code.
• AI tools and models used: Claude Code (Sonnet 5 and Haiku for implementation and per-task review, Opus 5 for the final whole-branch review)