feat(github-agent): add @gittensory command router v2

[JSONbored]

Background

A GitHub-native mention agent is the easiest way for maintainers and contributors to use Gittensory without installing MCP. It should be explicit, low-noise, and sanitized.

Goal

Build the v2 @gittensory command router for explicit mentions on installed repos.

Current Behavior

GitHub App behavior exists, but the next adoption step is a stronger command router with distinct command behavior.

Desired Behavior

@gittensory help, preflight, blockers, duplicate-check, miner-context, next-action, reviewability, repo-fit, and packet produce command-specific safe responses.

Implementation Requirements

• Parse explicit mention commands from issue comments.
• Authorize maintainers on installed repos.
• Allow PR authors to invoke allowed commands on their own PRs.
• Fail closed for unauthorized users and miner-detection outages.
• Record product usage and audit events.

Public/Private Output Boundaries

Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.

Acceptance Criteria

• Maintainers can invoke commands on installed repos.
• PR authors can invoke allowed commands on their own PRs.
• Unauthorized users fail closed.
• Non-miners do not trigger miner-specific public output.
• Tests cover parsing, authorization, and sanitizer invariants.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
• MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.