feat(agent): maintainer write-actions layer (request-changes/approve/merge/close/label)

[JSONbored]

Parent epic: #769 (Phase 1).

Goal

The cloud action layer: post GitHub reviews/merge/close/label on state, gated by autonomy (N1) + config (N2) + kill-switch (N4). Order least→most irreversible.

Deliverables

• auto-label-by-bucket → auto-request-changes → auto-approve → auto-merge (needs contents:write) → auto-close
• Each behind dry-run-first + per-repo opt-in
• Branch-protection-aware merge; templated kind close messages

Prereqs

N3 (write perm), #551 merge-readiness, #538 appeal/override, B6 (command-auth write-safety), B1/B2/B3 (gate reliability).

Context

src/github/app.ts (read-only on PRs today), gate engine (src/rules/advisory.ts, src/queue/processors.ts).

Milestone: M3.