Support GitHub PR targets in upgrade simulate

Problem

ocm upgrade simulate <env> --to <local-repo-path> can validate an exact checkout safely, but validating a GitHub pull request requires the operator to prepare that checkout manually first. During release triage this adds repeated setup and makes it easier to test a stale or different head than the one under review.

Proposed capability

Allow --to to accept either:

• owner/repo#123
• https://github.com/owner/repo/pull/123

The resolved target should:

1. record the repository, PR number, and immutable public head SHA;
2. materialize a run-owned temporary checkout at that exact head;
3. reuse the existing local-checkout simulation path unchanged;
4. clean only the run-owned checkout through the same ownership boundary used for simulation artifacts;
5. leave an explicitly supplied local checkout untouched;
6. fail clearly when the PR is unavailable, ambiguous, private without existing authentication, or changes head during resolution.

Maintainer decisions requested

• Should OCM rely on an installed authenticated gh, use public GitHub API + Git, or support only public PRs initially?
• Should cross-repository PRs be accepted, or only openclaw/openclaw?
• What target identity should be emitted in JSON so downstream release tooling can cite the exact head without parsing display text?

Alternatives

The existing local-path workflow remains valid and should stay as the lower-level primitive. A shell wrapper can prepare a checkout, but it cannot provide a consistent OCM-owned lifecycle or canonical target identity.

Impact

This affects maintainers and contributors repeatedly validating individual PRs or current-main combinations before release inclusion. It is workflow friction rather than a candidate defect, but it occurs on every PR validation run.

Start with the ocm upgrade simulate <env> --to <local-repo-path> entry point and trace the existing local-checkout simulation path and artifact ownership boundary. Before implementation, resolve the open decisions about GitHub authentication, cross-repository targets, and JSON target identity. Done means supported PR target forms resolve to an immutable head, reuse simulation, clean only owned checkouts, preserve supplied local paths, and fail clearly in the listed cases.