feature: pr-number / pr-url outputs

[friedrichwilken]

Summary

• Adds pr-number/pr-url outputs: set when this run created or edited the PR, empty in dry-run, when nothing was pushed, or on a failure before the PR step.
• Both are computed once in run() from a single construction (server_url/repository + the resolved PR number), shared by the create and edit paths, and reused as-is for create-issues' own issue bodies (no second way of computing the URL). If gh pr create's stdout can't be parsed, the run prints a ::warning:: and leaves both outputs empty rather than failing.
• Wires the outputs into action.yml (+ descriptions pointing at docs/manual/outputs.md), docs/manual/outputs.md (table row + a 5-line "use it" example), and one sentence in docs/manual/how-it-works.md.
• Rewrites tutorial step 9 (auto-merge) to the shorter form the issue proposed: one extra step in the same job (if: steps.update.outputs.pr-url != '') instead of a second, pull_request-triggered workflow keyed on the branch name. Step 10's recap collapses to a single workflow file. Drops the now-inapplicable fork paragraph, keeps the "Allow auto-merge" + required-status-check note (now a short "Needs:" list), and adds one sentence on why the PAT is still needed.
• Updates this repo's own .github/workflows/update_dependencies.yml to use the same auto-merge step (with its existing DEPS_UPDATE_TOKEN || github.token fallback).
• e2e: extends the existing "Assert reported outputs (basic scenario)" step (no new/renamed job) to assert pr-number/pr-url are present and empty in dry-run.

Review-fix round

• Untested failure paths: FakeGit gained push_ok, FakeGithubPR gained create_ok/edit_ok. New tests drive main() itself (not just run()) and prove a git push failure, a gh pr create failure, and a gh pr edit failure all leave pr-number/pr-url empty, still write every other output, and exit main() with code 1.
• GITHUB_TOKEN wording was factually wrong. Per GitHub's docs, a PR opened with the default GITHUB_TOKEN does trigger pull_request workflow runs - GitHub holds them in an approval-required state instead of starting them; someone with write access has to click "Approve workflows to run". The docs previously said these runs are "never triggered" at all, which is wrong (and understates how they can silently sit waiting). Corrected in: README.md, docs/manual/token-and-permissions.md, docs/tutorials/weekly-updates.md (step 3's intro + inline comment, step 9's PAT note).
• parse_created_pr_number: added direct unit tests (URL-only, a leading line before the URL, a GitHub Enterprise Server host, no URL -> None) and softened its docstring, which overclaimed the URL is always the only stdout line.
• Tutorial step 9: shortened intro (was a run-on sentence), non-overlapping arrow comments, and its two trailing prose paragraphs collapsed into a short "Needs:" list.
• tests/unit/test_tutorial_arrows.py's stale module docstring/assert message (referred to "two workflow lineages", no longer true) corrected - no test logic changed.

Closes #43

Verified

• uv run pytest tests/unit - 616 passed.
• uv run ruff check . / uv run ruff format --check . - clean.
• actionlint (from repo root, and directly against .github/workflows/*.yml) - clean.
• python3 .github/scripts/lint_docs_workflows.py (renders + actionlints every complete workflow example, uv and Poetry renditions) - clean.
• Ran the real updater in dry-run against a throwaway copy of tests/fixture/uv (uv run --no-project --python 3.14 -m updater, same invocation as action.yml): confirmed pr-number= and pr-url= both written empty in GITHUB_OUTPUT.
• Verified the GITHUB_TOKEN approval-required behavior against GitHub's own current docs rather than from memory.
• Live PR CI - all 14 required checks green.

Not verified (can't be exercised without a real GitHub repo/token): the actual gh pr create/gh pr edit create and edit paths against a real repo, and the live auto-merge step. These are covered by unit tests (tests/unit/test_run.py, tests/unit/test_github_pr.py) using FakeGithubPR/FakeGit and, for the failure paths, main() itself with every real collaborator monkeypatched out.

Deviations

• Coordinator's suggested wording named the term action_required for the held-run state; GitHub's own docs page actually calls it approval-required (verified via curl/WebFetch against the live page) - used the accurate term instead.
• Placed pr-number/pr-url in action.yml/outputs.md right before pr-body (logical PR-fields grouping) rather than at the end.
• Left README.md's line count unchanged (68/70 lines) - only reworded the existing bullet, no new line added.

🤖 Generated with Claude Code