firstrun pr: one approved step from a verified fix to a docs PR

pr finds the docs source repo and file from the page's edit link or a known-site table, re-targets patch.diff to the real path, and prints the gh commands to fork, branch, apply, commit, push and open the PR with pr_body.md. It runs none of them. --json gives an agent the same plan. An unverified run is refused.