fix(mosaic): reject unsafe pr merge numbers (#520)

packages/mosaic/framework/tools/git/pr-merge.sh

@@ -78,7 +78,7 @@ if [[ -z "$PR_NUMBER" ]]; then
 fi
 
 if [[ ! "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
-    echo "Error: PR number must be numeric." >&2
+    echo "Error: Invalid PR number '$PR_NUMBER'. PR number must contain digits only." >&2
     exit 1
 fi
 
@@ -228,9 +228,9 @@ fi
 
 case "$PLATFORM" in
     github)
-        GH_ARGS=(pr merge "$PR_NUMBER" --squash)
-        [[ "$DELETE_BRANCH" == true ]] && GH_ARGS+=(--delete-branch)
-        gh "${GH_ARGS[@]}"
+        cmd=(gh pr merge "$PR_NUMBER" --squash)
+        [[ "$DELETE_BRANCH" == true ]] && cmd+=(--delete-branch)
+        "${cmd[@]}"
         ;;
     gitea)
         HOST=$(get_remote_host) || {