bug: AI-resolved cherry-pick opens PR despite tox/pre-commit failures

[rnetser]

Bug Description

When AI resolves cherry-pick conflicts, the cherry-pick flow does not validate tox before pushing and creating the PR. Additionally, when pre-commit fails with unfixable errors, the abort path posts a vague "Manual intervention needed" message instead of following the standard failed cherry-pick flow with manual git instructions.

Since cherry-pick PRs are bot-owned, users cannot push fixes to them — so creating a PR that will fail CI wastes time and requires manual cleanup (close the broken PR, do the cherry-pick manually anyway).

Root Cause

Two issues in webhook_server/libs/handlers/runner_handler.py → cherry_pick():

1. Tox is never run in the cherry-pick worktree

After AI conflict resolution, the flow is:

1. AI resolves conflicts ✅
2. Scope verification (informational) ✅
3. Restore original author (DCO) ✅
4. Pre-commit runs ✅
5. No tox validation ❌
6. Push + PR creation → PR opened with code that fails tox in CI

The run_tox() method exists but is only called from the CI check run flow — never from the cherry-pick worktree flow.

2. Pre-commit abort messages are dead-ends

Three pre-commit failure paths (lines ~1672, ~1696, ~1709) post variants of:

"Cherry-pick pre-commit check failed with unfixable errors. Manual intervention needed."

This gives the user no actionable instructions. Compare to the proper failed cherry-pick flow (lines ~1511, ~1582) which posts:

**Manual cherry-pick is needed**
Cherry pick failed for <hash> to <branch>:
To cherry-pick run:
git remote update
git checkout <branch>
git pull origin <branch>
git checkout -b <local-branch>
git cherry-pick <hash>
git push origin <local-branch>

Since the PR is bot-owned, users can't push to it — they need the manual cherry-pick instructions to start fresh.

Expected Behavior

When AI resolves conflicts but tox or pre-commit fails:

1. Do NOT push the branch or create a PR
2. Post the standard "Manual cherry-pick is needed" comment with full git instructions on the original PR
3. Set the cherry-pick check run to failure

This should only apply when cherry_pick_had_conflicts == True (AI was involved). Clean cherry-picks don't need worktree-level tox validation since the original commit already passed CI.

Actual Behavior

• Tox failures: PR is created, tox fails in CI, user is stuck with a broken bot PR (see PR #5645)
• Pre-commit unfixable failures: No PR is created (correct), but the comment is a dead-end with no instructions for the user to proceed

Affected Code

• webhook_server/libs/handlers/runner_handler.py
  • cherry_pick() — lines ~1666–1720 (pre-commit block, missing tox block)
  • _resolve_cherry_pick_with_ai() — returns success but no downstream validation

Proposed Fix

1. Add tox validation in the cherry-pick flow between pre-commit and push (only when cherry_pick_had_conflicts):

   • Build the tox command the same way run_tox() does (using worktree_path)
   • Run it via run_command()
   • If tox fails → follow failed cherry-pick flow (manual instructions comment + check failure + return)

2. Replace all 3 pre-commit abort messages with the standard failed cherry-pick instructions block (same as lines ~1511/~1582), so users know how to proceed manually.

Impact

• Users get broken bot-owned PRs they can't fix (must close and redo manually)
• No indication that tox would fail until CI runs on the created PR
• Pre-commit abort path leaves users with no actionable next steps

Reference

• PR #5645 — AI resolved conflicts, tox failed on the created PR

Done

• Add tox validation in cherry_pick() after pre-commit, before push (only when cherry_pick_had_conflicts)
• On tox failure: follow failed cherry-pick flow (manual instructions + check failure + return, do NOT push/create PR)
• Replace 3 pre-commit abort messages (lines ~1672, ~1696, ~1709) with standard manual cherry-pick instructions
• Add tests for tox failure path in cherry-pick flow
• Add tests for pre-commit abort path producing manual instructions