feat(ci): pr-title-sync rewrites titles unconditionally

Drops the "eligible only if already prefixed" gate. Sources the new shared
helper, rewrites unconditionally on every VERSION change. Defense-in-depth
backstop for PRs opened outside the skills (manual gh pr create, web UI).

Uses env: for OLD_TITLE so YAML expression injection cannot reach run:.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/pr-title-sync.yml

@@ -25,40 +25,19 @@ jobs:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Read VERSION + current title
-        id: inspect
-        run: |
-          set -euo pipefail
-          VERSION=$(cat VERSION | tr -d '[:space:]')
-          TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH")
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          # Only rewrite titles that ALREADY follow the v<X.Y.Z.W> prefix pattern.
-          # Custom titles (no prefix) are left alone — user kept them intentionally.
-          if printf '%s' "$TITLE" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ '; then
-            PREFIX=$(printf '%s' "$TITLE" | awk '{print $1}')
-            REST=$(printf '%s' "$TITLE" | sed 's/^v[0-9][0-9.]* //')
-            {
-              echo "prefix=$PREFIX"
-              echo "rest=$REST"
-              echo "eligible=true"
-            } >> "$GITHUB_OUTPUT"
-          else
-            echo "eligible=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Rewrite title if version changed
-        if: steps.inspect.outputs.eligible == 'true'
+      - name: Rewrite PR title to match VERSION
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUM: ${{ github.event.pull_request.number }}
-          NEW_V: ${{ steps.inspect.outputs.version }}
-          OLD_PREFIX: ${{ steps.inspect.outputs.prefix }}
-          REST: ${{ steps.inspect.outputs.rest }}
+          OLD_TITLE: ${{ github.event.pull_request.title }}
         run: |
-          if [ "v$NEW_V" = "$OLD_PREFIX" ]; then
-            echo "Title already matches v$NEW_V; no change."
+          set -euo pipefail
+          chmod +x ./bin/gstack-pr-title-rewrite.sh
+          VERSION=$(cat VERSION | tr -d '[:space:]')
+          NEW_TITLE=$(./bin/gstack-pr-title-rewrite.sh "$VERSION" "$OLD_TITLE")
+          if [ "$NEW_TITLE" = "$OLD_TITLE" ]; then
+            echo "Title already correct; no change."
             exit 0
           fi
-          NEW_TITLE="v$NEW_V $REST"
-          echo "Rewriting: $OLD_PREFIX ... → v$NEW_V ..."
+          echo "Rewriting: $OLD_TITLE -> $NEW_TITLE"
           gh pr edit "$PR_NUM" --title "$NEW_TITLE"