feat(github-app): reviewer-routing auto_request action (#540 follow-up)

[JSONbored]

Follow-up to #540 (advisory reviewer routing, shipped in #829). #540's advisory core surfaces ranked CODEOWNERS reviewer suggestions in the PR panel; this issue adds the outward-facing auto_request action that was intentionally deferred because it actually assigns reviewers on real PRs.

Why split out

#829 shipped reviewerRoutingMode as off | advisory. Actually requesting reviewers via the GitHub API is outward-facing and warrants its own focused review (and the strict opt-in guards the parent issue calls for). The setting column is TEXT, so this adds the enum value + action with no migration.

Deliverables

• Add auto_request to the reviewerRoutingMode union (src/types.ts, parseReviewerRoutingMode in src/db/repositories.ts, the openapi enum, settings-preview, and the .gittensory.yml settings-block enum in focus-manifest.ts).
• When reviewerRoutingMode === "auto_request", call GitHub's request-reviewers API for the top-ranked buildReviewerRouting suggestion(s) — using the existing installation-token GitHub client (this is the first reviewer-routing call needing the App token, vs the public raw fetch the advisory core uses).
• Strict opt-in guard (acceptance criterion): never auto-request for a first-time external contributor without explicit opt-in. Reuse the newcomer detection already threaded for feat(github-app): first-time-contributor-aware gating #552 (0 merged PRs in this repo) so a genuine newcomer's PR is never auto-assigned.
• Skip teams / already-requested reviewers; idempotent (don't re-request on every webhook).
• Tests: the opt-in guard (newcomer → no auto-request), the action fires only under auto_request, idempotency.

Context

src/signals/reviewer-routing.ts (the ranked suggestions), src/queue/processors.ts maybePublishPrPublicSurface (where routing is built), the newcomer detection at the gate-policy threading (#552). Relates #540, #829, #525/#528.