chore(agent): GitHub App write permission + re-consent flow

[JSONbored]

Parent epic: #768 (Phase 0).

Goal

Upgrade the GitHub App from pull_requests: read to pull_requests: write (and later contents: write for auto-merge), with an explicit maintainer re-consent. Owner has approved switching to write.

Deliverables

• Update GitHub App permissions (App settings) — pull_requests: write
• Update requested-permission constants + health audit
• Re-consent comms / installation prompt; defer contents:write until auto-merge (N6 step)
• Verify on a test repo before broader rollout

Context

src/github/backfill.ts (permission constants + health audit), src/signals/settings-preview.ts.

Milestone: M2.