remediate

type Options struct {
	// Owner is the GitHub org or user that owns the GitOps repo.
	Owner string
	// Repo is the GitHub repository name.
	Repo string
	// Finding is the finding to act on; must carry a non-empty YAML remediation.
	Finding report.Finding
	// Cluster is the cluster the remediation targets.
	Cluster string
	// Token is the GitHub personal access token or app token with repo write.
	Token string
	// BaseBranch overrides the default branch detected from the repo. Empty
	// means "use whatever the repo reports as its default".
	BaseBranch string
	// HeadBranch is the new branch name to create. When empty a slug derived
	// from the finding title is used.
	HeadBranch string
	// TargetPath is the path inside the repo where the manifest is written.
	// When empty the path defaults to "fleetsweeper/<cluster>/<slug>.yaml".
	TargetPath string
	// Push controls whether to actually call GitHub. When false the function
	// returns the planned change for review without touching the network.
	Push bool
	// BaseURL overrides the GitHub API endpoint. Used by tests; leave empty
	// in production.
	BaseURL string
	// HTTPClient overrides the default HTTP client. Used by tests.
	HTTPClient *http.Client
}

type Result struct {
	// PRURL is the URL of the created pull request. Empty when Push is false.
	PRURL string `json:"pr_url,omitempty"`
	// PRNumber is the pull request number. Zero when Push is false.
	PRNumber int `json:"pr_number,omitempty"`
	// HeadBranch is the branch that holds the change.
	HeadBranch string `json:"head_branch"`
	// BaseBranch is the branch the PR targets.
	BaseBranch string `json:"base_branch"`
	// TargetPath is the in-repo path of the manifest.
	TargetPath string `json:"target_path"`
	// PlannedYAML is the manifest body that was (or would have been) written.
	PlannedYAML string `json:"planned_yaml"`
	// PRTitle is the pull request title.
	PRTitle string `json:"pr_title"`
	// PRBody is the pull request body, rendered as Markdown.
	PRBody string `json:"pr_body"`
	// DryRun is true when Push was false; nothing was written.
	DryRun bool `json:"dry_run"`
}