1.0: Treat patch records as untrusted in pr diff, checkout and checks · Issue #1328 · permadeath.com/atgc

Goal: pr diff, pr checkout and pr checks validate record-derived git input and print record text safely.

major: pr checkout passes a record's oid to git unvalidated, and head=--force discards work. src/cmd/pr/read/tickets.rs:389-399, 572-595, src/cmd/pr/review.rs:495-509, 679-690.
minor: pr diff and pr checkout print the pull title uncleaned. src/cmd/pr/review.rs:312, 375-388, 682.
minor: pr checkout --json credits the last editor as the opener. src/cmd/pr/review.rs:621.
minor: Stale blob and worktree leftovers. src/cmd/pr/review.rs:81-83, 753-755, src/clients/git/worktree.rs:6-7, src/cmd/pr/read/mod.rs:17-19.
minor: docs/testing.md says pr checkout has no listing or index. docs/testing.md:51.
minor: The no-versions error gives no index-lag hint. src/cmd/pr/review.rs:247-254, 611-619, src/cmd/pr/checks.rs:66-73.
minor: docs/testing.md has no H1 at the top and names State::Unknown. docs/testing.md:1, 25, 165.