fix(submit-proposals): pipe commit message and PR body via stdin (B10)

Bug surfaced in production on 2026-04-19 while opening a proposal batch
PR via `submit-proposals.ts --pr`. Two symptoms:

1. commit message came out with empty slots where term IDs should be:
     -  (zk-compression): Bubblegum Asset PDA
     -  (zk-compression): cNFT Tree Pool
   instead of the expected `bubblegum-asset-pda (zk-compression): ...`.

2. `gh pr create` failed outright with errors like
     /bin/sh: 1: bubblegum-asset-pda: not found
     /bin/sh: 1: validate-term-proposal.ts: not found
   (one per backtick in the body) and returned exit code 1, so
   `pr_url` came back null even though the branch + commit had been
   made successfully.

Root cause: both `commitProposals` and `submitPr` embedded the message/
body into the shell command string via template literal, only escaping
double quotes. Any backtick in the text (plentiful: term IDs are
formatted as `` `id` ``, and the PR body had an inline code block
mentioning `validate-term-proposal.ts`) was interpreted as command
substitution by /bin/sh, which then tried to execute each ID as a
shell command.

Fix: pipe the message via stdin using the native "read from stdin"
options — `git commit -F -` and `gh pr create --body-file -`. execSync
accepts an `input` option that pipes a string to stdin of the spawned
process, so there is no shell quoting step at all.

Validation: full submit-proposals --pr flow run end-to-end, produced a
real PR (solanabr#47 against solanabr/solana-glossary) with correct commit
message and correctly-rendered body. typecheck clean.

Author: zupy-fmartinelli

apps/kuka-agent/skills/kuka/scripts/submit-proposals.ts

@@ -555,9 +555,14 @@ function commitProposals(
 ): void {
   const pluralSuffix = proposals.length > 1 ? "s" : "";
   const commitMsg = `feat(glossary): add ${proposals.length} community-proposed term${pluralSuffix}\n\nTerms proposed by Kuka agent during teaching conversations:\n${termList}`;
-  const escapedCommitMsg = commitMsg.replaceAll('"', String.raw`\"`);
-  execSync(`git commit -m "${escapedCommitMsg}"`, {
-    stdio: "pipe",
+  // Bug fix B10 (2026-04-19): pipe the commit message via stdin instead of
+  // embedding it in the shell command. The termList format includes `id`
+  // backticks, which /bin/sh interpreted as command substitution, producing
+  // a commit message with empty slots where the term IDs should be. Using
+  // `git commit -F -` bypasses shell quoting entirely.
+  execSync("git commit -F -", {
+    input: commitMsg,
+    stdio: ["pipe", "pipe", "pipe"],
   });
 }
 
@@ -587,11 +592,19 @@ Generated by Kuka 🎓 — Solana Glossary Teaching Companion`;
 
 function submitPr(repo: string, proposals: Proposal[], termList: string): string {
   const prBody = buildPrBody(proposals, termList);
-  const escapedPrBody = prBody.replaceAll('"', String.raw`\"`);
   const prTitle = `feat(glossary): add ${proposals.length} community-proposed terms`;
+  // Bug fix B10 (2026-04-19): pipe the PR body via stdin using --body-file -.
+  // The body contains `id` backticks and code-fenced blocks that /bin/sh
+  // interpreted as command substitution, causing `gh pr create` to either
+  // fail outright or render an empty body. --body-file - reads raw bytes
+  // from stdin, sidestepping shell quoting.
   const result = execSync(
-    `gh pr create --repo ${repo} --title "${prTitle}" --body "${escapedPrBody}"`,
-    { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] },
+    `gh pr create --repo ${repo} --title "${prTitle.replaceAll('"', String.raw`\"`)}" --body-file -`,
+    {
+      input: prBody,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+    },
   );
   return result.trim();
 }