publish-issue-format Merge target contract

Merge target is a required field in the canonical body-start request header, not a separately searchable issue-body property. Chose extracting it from the Peggy-parsed header over /^Merge target:/m scanning because a later decoy line can otherwise control Craft’s merge target while release revision remains canonical. Trap: requiring the field in grammar looks sufficient because the header validates, but discarding its value lets another parser read attacker-controlled content. Fix: return and validate the parsed header value as the sole authority; (default) maps to the repository default branch.