librarystore: auto-create library repo via go-github API (keep git for content)

[antoinetoussaint-byte]

Summary

pkg/librarystore (the durable versioned library publishing store, cli#446/#447) publishes library content over raw git (clone/add/commit/tag/push) — which is correct and should stay that way. But it has a gap: it does not create the target repository. Publish assumes the repo already exists and errors out otherwise (github.go:135: "create the library repository first if it does not exist yet").

Repo creation is a GitHub platform operation, not a git operation, and is the right place to use the github.com/google/go-github/v89 API (already a direct dependency, go.mod:22).

Why the API here (and only here)

Content publishing in GitHubStore (github.go) is all git and stays git:

• git clone (:134), git add -A (:147), signed-off git commit (:155), git tag -a (:161), git push branch + tag (:178, :181), git ls-remote --tags (:294), shallow clone for digestAtTag (:360), treeDigest via git ls-files --stage (:495).

Reimplementing any of that over the REST API would be slower and lossier. The only missing piece that git can't do is creating the remote repo — that's an API call.

Proposed change

Add a "create repo if missing" step to the Publish path in pkg/librarystore/github.go:

• Before clone, check existence via client.Repositories.Get.
• If absent, client.Repositories.Create (org-owned, correct visibility/default branch) — then proceed with the existing git clone/commit/tag/push.
• Make it opt-in or idempotent so it's safe to re-run; surface a clear error if the token lacks repo-creation scope.
• Reuse the shared client/token helper (see Migrate agent-release publishing from gh CLI to go-github API #457).

Acceptance

• Publish auto-creates the library repo when it doesn't exist, then publishes via the existing git path.
• Existing git-based clone/commit/tag/push flow unchanged.
• Clear, actionable error when the token can't create repos (falls back to today's "create it first" message).
• Idempotent — re-running against an existing repo is a no-op for creation.

Out of scope

• Python (pip) / TypeScript (npm) publishing — still "not implemented yet" (github.go:100/223/263); tracked separately under the library-publishing epic (Epic: durable versioned library publishing — storage abstraction for go get / pip / npm #446).

Part of #460.