feat: add guarded Git and pull request tools

[nahin-fr]

Summary

Adds opt-in guarded Git and draft pull-request MCP tools for Agent and Handoff modes.

Security boundaries

• Explicit paths only; no implicit staging.
• Protected branches and destructive Git operations are blocked.
• Handoff stage/commit scope defaults to .ai-bridge/** and validates the full staged set.
• Push and PR require expected branch, expected HEAD, and confirmation.

Configuration

• Agent: CODEXPRO_GIT_WRITE, CODEXPRO_GIT_PUSH, CODEXPRO_GITHUB_PR.
• Handoff: CODEXPRO_HANDOFF_GIT_WRITE, CODEXPRO_HANDOFF_GIT_PUSH, CODEXPRO_HANDOFF_GITHUB_PR, CODEXPRO_HANDOFF_GIT_ALLOWED_PATHS.

Validation

• npm run build
• npm run smoke
• Disposable Git integration including temporary bare-remote push and mocked PR creation.
• Local Agent/Handoff services run this feature build on ports 8788/8789.

Rollback

Restore the backed-up LaunchAgent wrappers and restart both services.

No merge, force-push, reset, clean, rebase, branch deletion, remote mutation, or other destructive Git action is exposed.

[rebel0789]

This guarded Git/PR feature is potentially useful, but it is not ready to merge in its current conflicted draft form. Please keep it as a draft and update the following:

1. Rebase onto current main after PR Harden Windows runtime and skill precedence #80 and resolve the config, server, changelog, and smoke-suite conflicts.
2. Keep the write surface narrowly opt-in. Consider separating local stage/unstage/commit from remote push/PR creation so each security boundary can be reviewed independently.
3. Add regression coverage proving:
   • protected branches remain blocked;
   • the complete staged set stays inside the allowed workspace/handoff paths;
   • symlink, worktree, and path-alias cases cannot escape the allowed scope;
   • expected branch and expected HEAD checks fail closed under concurrent changes;
   • command arguments are not shell-reinterpreted on Windows.
4. Run the current Ubuntu and Windows CI matrix through build, full smoke, stress, and package checks.

Once those points are addressed, this can be reviewed as contributor work rather than replaced. Leaving it open as a draft.