fix(pulls): report stack merge API permission errors

Assisted-by: Codet:GPT-5-Codex

modules/task/pull_stack_test.go

@@ -227,3 +227,17 @@ func TestMergePullStackPartialFailure(t *testing.T) {
 	require.NotNil(t, result)
 	assert.Equal(t, int64(1), result.Merged)
 }
+
+func TestMergePullStackPermissionDenied(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = w.Write([]byte(`{"message":"merge not permitted"}`))
+	}))
+	defer server.Close()
+	result, queued, err := MergePullStack(t.Context(), &config.Login{
+		Name: "test", URL: server.URL, Token: "secret-token",
+	}, "owner", "repo", 6, "merge", false)
+	require.ErrorContains(t, err, "merge not permitted")
+	assert.False(t, queued)
+	assert.Nil(t, result)
+}