fix(root): early-exit iyarc-prune cron only for open PRs

[ralph-bitgo]

What

• Rewrites the "Early exit" section of the iyarc-prune agent prompt
  (.claude/agents/iyarc-prune.md) so only an open PR on an
  osv-scanner-prune/* head branch blocks a run.
• Replaces the search-based check
  (gh pr list --state open --search "head:osv-scanner-prune/") with a
  state-filtered JSON + jq command whose empty / non-empty output maps
  directly to "continue" / "stop and report".
• Explicitly forbids inferring an open PR from branch existence or from
  --state all / --state merged listings — branches from merged prune
  PRs linger until deleted and must not trigger the early exit.

Why

The cron exited early whenever it found a PR on an osv-scanner-prune/*
branch, even when that PR was already merged or closed. Once a prune PR
merges, every subsequent weekly run would keep exiting early, the cron
stalls indefinitely, and stale osv-scanner.toml exclusions go unpruned —
defeating the purpose of the weekly prune.
Ticket: WCN-2575

Observed in run 33363611227:
the agent ended the run in 2 turns after matching an existing PR instead of
evaluating exclusions.

Test plan

• The new check command was validated against the live repo: with PR
  chore(deps): remove GHSA-v2hh-gcrm-f6hx from osv-scanner.toml #9450 merged and chore(deps): bump fast-uri to 3.1.4, tar to 7.5.22, drop 8 exclusions #9355 closed, gh pr list --state open --json number,state,headRefName --jq '.[] | select(.headRefName | startswith("osv-scanner-prune/"))'
  returns empty (exit 0), so the next cron run proceeds with pruning work.
• With --state all the same jq filter matches both prior prune PRs,
  confirming branch-prefix matching is preserved.
• Next scheduled cron run (Mondays 06:00 UTC) completes with actual
  pruning work or a "no exclusions prunable" report instead of a
  PR-existence early exit.

Ticket: WCN-2575

[linear-code]

WCN-2575