CI guard to block out-of-order stacked PR merges

## Problem

Nothing stops a stacked PR from being merged before its downstack
dependencies have landed. Merging mid-stack out of order corrupts the
stack: the merged PR pulls in commits from branches below it that were
never reviewed or merged on their own, and the remaining PRs retarget
against an unexpected base.

## Proposal

Add `gs ci merge-guard `, a CI/CD subcommand intended to run in
forge pipelines. It fails when a PR's base branch is not trunk, i.e.
when the PR still has unmerged downstack dependencies.

Behavior:

- By default only git-spice managed PRs are checked; unmanaged PRs pass
through. `--all` blocks any PR whose base is not trunk.
- Trunk is auto-detected from a `gs:trunk` metadata marker embedded in
the navigation comment, so the command needs no local state and can
run against any PR number in CI. `--trunk` overrides detection.
- Exits 0 when safe to merge, non-zero with a descriptive error
otherwise.

Note: the trunk marker overloads the navigation comment to carry
metadata, which is more load-bearing than before — open to alternative
mechanisms for tracking trunk across forges.

## Tracked by

- #1153 — `gs ci merge-guard` command