Add idempotent GitHub publication for repository runs

[ferueda]

Summary

• add a standalone lib/github primitive that commits an approved repository-run change set, pushes one stable branch, and finds or creates one exact pull request
• recover safely across retries by observing the marked local commit, remote branch SHA, and GitHub pull request identity
• keep credentials inside the constructed publication service and isolate token-bearing Git from agent-controlled worktree configuration
• document and enforce the publication boundary without coupling it to Inngest, Linear, Spec policy, repository cleanup, or a generic workflow engine

Why

This completes the publication primitive required by FER-286. The upcoming Spec consumer needs a small retry-safe boundary for turning validated isolated repository changes into one reviewable GitHub pull request.

The primitive deliberately keeps recovery state-free: Inngest may retry the call, while the module converges from observable Git and GitHub state. It does not add internal retry loops, publication phases, a database, Octokit, or a provider framework.

Safety and behavior

• validates the workspace, branch, base SHA, remote identity, and approved path/status set before credentials are used
• recognizes only one exact child commit carrying the stable Harness-Run-ID trailer
• never force-pushes or repairs conflicting local/remote state
• performs at most one recovery observation after an ambiguous push or PR-create failure
• runs authenticated Git from a temporary isolated bare repository and pushes the exact verified commit SHA
• keeps tokens out of arguments, remotes, durable data, logs, and agent processes, with defensive error redaction
• returns existing exact open, closed, or merged PRs without overwriting later human title/body edits

Validation

• make check — format, lint, typecheck, full tests, build, and distribution smoke pass
• 29 focused GitHub tests pass, including real temporary repositories and a local bare remote
• hostile worktree Git configuration regression proves token-bearing Git cannot be redirected by local config
• change review 20260723-214543-d3c25e passes implementation and quality with zero findings
• targeted API-version review 20260723-220342-281920 passes with zero findings
• authorized live smoke created disposable PR [smoke] GitHub publication 1784843543679-94148 #246, repeated publication converged on the same PR and SHA, then the PR was closed and its remote branch and local workspace were removed
• current-version live smoke created disposable PR [smoke] GitHub API 2026 1784844183076-41217 #248 through GitHub REST API 2026-03-10, repeated publication converged, then the PR was closed and its remote branch and local workspace were removed