Read a Positional Repository and the Missing Write Subcommands in the Write Guard #3133

Context

Found by the local review of the lane closing #3093, #3080, #3067, #3089, #3079, and #3069. Develop's guard shares both gaps. Each was confirmed with classify probes on constructed commands, origin example/repo, against develop's guard and that lane's branch.

A Repository Named as a Positional Argument Is No Target

gh takes a write's repository from a positional argument in several shapes, and the cross-owner check reads none of them. Each of these is allowed:

• gh pr comment https://github.com/stranger/example/pull/5 --body x
• gh issue comment https://github.com/stranger/example/issues/5 --body x
• gh repo edit stranger/example --description x
• gh issue transfer 5 stranger/example

The URL form is a shape an agent writes when it copies a link.

The Write Subcommand Table Misses Writes

_GH_WRITE_SUBS lists the gh subcommands read as writes, and these writes are absent from it, so each is allowed with a foreign repo flag:

• gh pr update-branch 5 -R stranger/example
• gh workflow run ci.yml -R stranger/example
• gh run rerun 123 -R stranger/example
• gh issue develop 5 -R stranger/example
• gh cache delete --all -R stranger/example
• gh label clone example/repo -R stranger/example

Possible Direction

Add the missing write subcommands to the table, and read a pull request or issue URL, and the positional repository gh repo and gh issue transfer take, as a target. Check the verdict changes with a develop-versus-branch differential.