AutoFix opens the pull request

For findings with one correct answer, AutoFix produces the actual patch and opens it as a pull request on the connected repository. The team reviews and merges it like any other change.

The patches are deterministic, derived from the scanner's structured output rather than generated fresh each time, so the same finding always produces the same diff. That was a deliberate decision: a reviewable patch beats a clever one.