test: mock create-pr git subprocess calls

[sanmaxdev]

Summary

Reworks the create-pr helper tests so git subprocess behavior is mocked in-process instead of creating and committing in a temporary git repository.

Why this change

The staging test no longer depends on machine-level git author configuration.

What changed

• Mocked node:child_process for create-pr helper tests.
• Replaced the temp git repository setup with assertions against the expected git add calls.
• Added branch-name subprocess assertions for the existing-branch path.

Validation

• npm run build
• npm test -- --runInBand tests/create-pr.test.ts
• node dist/index.js advisories sync
• npm test -- --runInBand

User-facing impact

Does this change:

• affect scanning behavior
• affect output formatting
• affect JSON output
• affect docs only

Notes

Closes #754