ci: close issues on release and note fixes merged into develop

[MarTrepodi]

Summary

GitHub only acts on closing keywords in PRs merged into the default branch (main). Every PR here merges into develop, so the 10 issues fixed in v2.5.0 stayed open and were closed by hand. This carries the keywords through to main, and tells the issue as soon as its fix lands on develop.

 PR "Closes #N" ─merge─▶ develop
-                          (keyword recorded, never fires)
+                          └─ push ─▶ issue-fixed-in-develop.yml
+                                      └─ comment on #N: "fixed in develop, closes on release"
 prepare-release ─▶ release PR body
+                     └─ closing_issues.py release: "- Closes #N (via #PR)" per open issue
 release PR ─merge─▶ main
-                      (no keywords: issues stay open)
+                      └─ GitHub closes #N

.github/
├── tools/closing_issues.py          # parse keywords from PR bodies + commit messages
│     release --since <tag>          #   → "Closes" section for the release PR
│     develop --sha <merge commit>   #   → comment on each open issue (idempotent marker)
└── workflows/
    ├── prepare-release.yml          # + step that writes the "Closes" section
    └── issue-fixed-in-develop.yml   # new; on push to develop

Evidence

• Before: v2.5.0's release PR had no closing keywords → 10 issues left open after release.
  After: release --since v2.4.0 at v2.5.0 renders exactly those 10:

  - Closes #157 (via #166)   …   - Closes #165 (via #166)
  - Closes #167 (via #168)
  

• develop --sha 19cf42b --dry-run (the fix: library bugs in rendering, stamina, migrate excludes, GAC brackets and StatCalc #166 merge) → would comment on parse_swgoh_string(output="discord") leaves unclosed styles open #157–StatCalc drops the stats of a mod that has no set, not just its set bonus #165; a non-merge commit → no-op.
• Parser follows GitHub's rules — 16 cases pass, including:

  `Fixes #1, #2`              → [1]       one ref per keyword, as GitHub does
  `prefixes #3`               → []        whole-word keywords only
  PR template's <!-- Closes … --> hint → []   HTML comments and code ignored
  `other/repo#5`              → []        same-repo refs only
  

• Workflows pass check-jsonschema; tool passes ruff (locked) and ty.

Merge Danger

Door: two-way

Delete the workflow and the prepare-release step to undo. Comments already posted stay, but they're informational.

Blast Radius: issues

• After merge, every push to develop that merges a PR with a closing keyword posts one comment per open issue. A hidden marker stops duplicates on re-runs.
• Uses push, not pull_request_target, so no fork code runs with a write token. The job token has issues: write only.
• The release PR body gains a "Issues resolved by this release" section; maintainers must keep it when copying the body in, or the issues won't close.

🤖 Generated with Claude Code