test: require TEST_PR_ID for write integration tests to prevent accidental mutations

Write tests no longer pick a random open PR. RUN_WRITE_TESTS=true alone is not
sufficient — TEST_PR_ID must also be set, otherwise each write test is skipped
with a warning. Added try/finally cleanup blocks so approval/comment/task state
is always restored even on assertion failures. Updated .env.example and README
to document the new requirement.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

README.md

@@ -245,13 +245,13 @@ npm start
 ### Testing
 
 ```bash
-# Run tests
+# Run all tests (unit only by default)
 npm test
 
 # Run tests in watch mode
 npm run test:watch
 
-# Integration tests (requires valid credentials)
+# Integration tests — read-only, requires valid credentials in .env
 npm run test:integration
 
 # Type check
@@ -261,6 +261,15 @@ npx tsc --noEmit
 npm run test:coverage
 ```
 
+**Write operation tests** (approve/unapprove, comments, tasks) are disabled by default. To enable them, set two variables in your `.env`:
+
+```env
+RUN_WRITE_TESTS=true
+TEST_PR_ID=123   # ID of a PR you own and can safely modify
+```
+
+`TEST_PR_ID` is required — write tests will not fall back to a random PR. If it is not set, each write test is skipped with a warning. This prevents accidental modifications to production PRs.
+
 ### Project Structure
 
 ```