Problem

The GitHub App fallback PR path is being handled in promptdriven/pdd_cloud PR #1802, but the PDD CLI itself can still create or update PRs without deterministically finalizing .pdd/meta/<module>_<lang>.json fingerprints.

If a CLI-created PR changes a PDD-owned prompt/code/example/test file but omits the matching fingerprint, later pdd sync, drift detection, checkup, or auto-heal can treat completed work as stale and create avoidable metadata churn.

Originating split: promptdriven/pdd_cloud#1800.
Fallback-path PR: promptdriven/pdd_cloud#1802.

Scope

Add deterministic PR-boundary metadata finalization for CLI-created PR/update flows:

• pdd bug
• pdd fix
• pdd change
• pdd checkup --fix / review-loop fix commits

Also add a final audit/safety check before success reporting or push completion.

Required behavior

• Detect changed PDD-owned prompt/code/example/test files in the PR worktree.
• Resolve touched modules through .pddrc, architecture, and existing path-resolution helpers.
• Run deterministic metadata sync/fingerprint writing, using existing PDD machinery such as run_metadata_sync(...) / save_fingerprint(...).
• Stage only expected fingerprint files returned by finalization.
• Use scoped staging, not git add -A or blanket .pdd staging.
• Use git add -f -- <exact-fingerprint-path> only for expected fingerprints, because target repos may ignore .pdd/meta.
• Ignore transient .pdd state and unrelated .pdd/meta/*.json files.
• Fail clearly, or push a narrowly scoped follow-up commit, if a changed PDD-owned module is missing a fresh fingerprint.

Acceptance criteria

• CLI-created PRs that change any PDD-owned prompt/code/example/test file include the matching fresh .pdd/meta/<module>_<lang>.json fingerprint.
• Fingerprints are generated by deterministic PDD code, not by LLM prompt convention.
• pdd change no longer relies on agent instructions like git add -A for PR-boundary staging.
• pdd bug, pdd fix, and pdd checkup --fix run finalization before commit/push or perform an equivalent final audit.
• Random .pdd artifacts and unrelated .pdd/meta/*.json files are not committed.
• Missing/stale metadata causes a clear failure or scoped autoheal commit, not silent success.
• Tests cover the CLI-created PR flows above.