Add GitHub integration execution surface and shared call boundary

[amirbena]

Fixes #547

What

• Behavior / contracts: Adds a shared GitHub call/auth boundary (scripts/github_integration/boundary.py) with separate read, non-governance write, and governance-mutation entry points; the last is refused without an explicit-authorization argument. Execution-surface decision recorded in docs/github-integration/execution-surface.md.
• Governance / policy: None
• Packaging / portability: None — repository tooling only; nothing added to Skill archives.
• Changelog: generated at release from the two lines below — never edit CHANGELOG.md (see docs/RELEASE.md)
• Release category: none
• Release entry:

Validation

• Relevant validation was run, or the reason it could not be run is stated.
• New mocked-boundary unit tests (21) pass; live read-only gh api calls exercised the real transport; markdown-link and skill-metadata validators pass. Full unittest discover result not confirmed locally (timed out); left to CI.

Review

Local review (local-code-review, on diff): two rounds found and fixed a write-guard bypass, a lost-response-body transport bug, and smaller hardening items. Final result: REVIEW CLEAN at c422b83.

🤖 Generated with Claude Code