Read a gh Write Subcommand Past Flags Between pr and It in the Write Guard #3080

Context

Found by the local review of the pull request closing #3006 and #3004. It was confirmed with classify probes on constructed commands against develop's guard.

A Flag Between pr and the Write Subcommand Hides the Write

_GH_WRITE_SUB matches a write only where its subcommand follows pr or issue directly, so a flag placed between them hides the write from the cross-owner check:

• gh pr -R stranger/example merge 5 is allowed under an origin of example/repo.
• gh pr --repo=stranger/example merge 5 is allowed the same way.
• gh pr -R example/repo merge 5 -R stranger/example is allowed, and gh takes the last -R.

The new merge readings step past pr's flags with _runs_gh_pr_merge, which passes one word per flag and two for a repo flag. Cobra reads an unknown flag written without = as taking the next word, so gh pr --squash 5 merge "$(printf %s --admin)" may run a merge the run-time word check does not read as one. That shape has not been run against gh.

Possible Direction

Read the subcommand after pr or issue the way cobra finds it, past any flags and their values, in both _GH_WRITE_SUB and _runs_gh_pr_merge, and check the write's targets wherever the subcommand sits.