feat(github-mcp): add comment_edit to edit existing comments

[Martin Bens (SpiGAndromeda)]

The plugin could create comments but not correct them. issue_comment, pr_comment and pr_review_reply only post new ones, the write server's api tool sends no request body, and the hook blocks gh pr comment --edit-last. This adds the write tool comment_edit, which replaces the body of an existing comment given its URL.

comment_edit {"url":"https://github.com/OWNER/REPO/pull/128#discussion_r4193579918","body":"Fixed wording."}
→ https://github.com/OWNER/REPO/pull/128#discussion_r4193579918

comment_edit {"url":"OWNER/REPO/pull/128#issuecomment-4581345917","body":"…"}
→ Error: comment_edit: the comment was written by github-actions[bot], not by you; nothing was edited. Pass allow_other_author: true to edit it

Changes

• The URL picks the endpoint (tool_comment_edit in lib/review_write.sh): GitHub numbers issue comments, inline review comments and reviews in separate sequences, so a bare ID does not say which endpoint to call. The anchor does: #issuecomment-ID goes to PATCH issues/comments/ID, #discussion_rID (or #rID in the Files, Changes and commit views of a PR) to PATCH pulls/comments/ID, and #pullrequestreview-ID to PUT pulls/N/reviews/ID. The URL works with or without https://github.com/, a notification link's query string is ignored, and any other URL fails before a request.
• Read before writing: the tool reads a conversation or inline comment first and refuses it when it does not belong to the issue or PR named in the URL, so a wrong number cannot edit a comment somewhere else. A review summary is read through pulls/N/reviews/ID, which already carries the PR number.
• Own comments by default: for a submitted comment or review summary, the tool asks GitHub through viewerDidAuthor whether the caller wrote it, and refuses otherwise. allow_other_author: true skips the check, so moderation edits stay possible.
• Pending review comments: the REST endpoint answers 404 for a comment in an unsubmitted review. On a 404 for an inline comment, the tool looks the comment up in the PR's pending reviews through GraphQL and edits it with the updatePullRequestReviewComment mutation. The 404 and the lookup's result both appear in the error when nothing matches.
• No fallback or suppress_errors: every other tool declares both, but fallback would turn a failed edit into a success, so comment_edit declares neither and every failure is a tool error.
• Hooks: check-api-tools.sh (the api tool, under block_api_tool_write) and check-gh-tools.sh (raw gh api, under block_api_commands) send PATCH on issues/comments/ID and pulls/comments/ID and PUT on pulls/N/reviews/ID to comment_edit. The block messages for gh pr comment and gh issue comment name it for editing an existing comment.
• Tool description: it avoids the words "review" and "reviews", because with them pi's tool_search ranks pr_reviews below its allowed rank. REFERENCE.md uses the plain terms.
• Docs: REFERENCE.md documents the URL forms, the checks and the errors; the README, SETUP.md and its plugin-setup copy, the SessionStart directive and the MCP issue template list the tool. The plugin-setup CHANGELOG.md records the new permission pattern.

Known limits

• Commit comments and Discussions comments are not supported.
• A comment found in a pending review gets no author check from the tool; whether the edit is allowed is left to GitHub's mutation. The lookup reads the first 100 pending reviews of the PR and up to 50 pages of comments.
• The author check has only been run with a user token. With a GitHub App or Actions token, viewerDidAuthor is untested; if it refuses the token's own comment, allow_other_author: true is the way around it.