feat: standardize GitHub platform ops on go-github, keep git for content (#460)

[antoinetoussaint-byte]

Closes#460.
Closes#459.

Summary

Aligns GitHub integration on one principle: git for content operations, the go-github API for platform operations. This is the remainder of #460 after #457's agent-release migration landed separately in #462 — reconciled onto the shared pkg/gh helper that #462 introduced (rather than the separate pkg/github this branch originally added, which would have duplicated the client/token path and collided with the github import name).

No new dependency — github.com/google/go-github/v89 was already direct.

What moved to the API

Call site	Before	After
pkg/gitops/publish.go — promotion PR	gh pr list/create/edit/view	PullRequests.List/Create/Edit/Get
cmd/status/release.go — chore issue	gh issue create	Issues.Create
pkg/librarystore/github.go — repo creation gap	errored: "create the repo first"	Repositories.Get then Create when missing (content publish stays on git)

pkg/gh gains RepoAtDir/ParseRemote (owner/repo from the origin remote) alongside the existing NewClient/Token/Owner.

Note: the agent-release publishing migration (cmd/publish/agent_release.go, cmd/agents/versions.go) and the shared helper originally in this branch were merged ahead of this in #462 (closes#457). This branch was rebased onto that result: the superseded parts were dropped and every remaining call site now reuses pkg/gh.

Deliberately kept on gh / git

• pkg/gitops/observe.go still uses gh pr view for the promotion gate: it reads reviewDecision, a GraphQL-only field with no go-github REST equivalent. Deriving it from REST review lists would weaken a security gate (it would ignore required-reviewer / CODEOWNERS policy), so this read stays as-is.
• All git content ops (clone/add/commit/tag/push/ls-remote/ls-files) stay on the git binary.
• The gh auth token credential fallback stays — a convenience, not a hard dependency.

Test plan

• go build ./..., go vet, gofmt clean
• go test ./pkg/gh/... ./pkg/gitops/... ./cmd/status/... ./pkg/librarystore/... ./cmd/publish/... ./cmd/agents/...
• New pkg/ghParseRemote cases (HTTPS/SSH/ssh://, trailing slash, non-github.com host rejected)
• Promotion-PR, chore-issue, and library-repo-creation tests drive the go-github flow against a local httptest server via the newGitHubClient seam

🤖 Generated with Claude Code

[antoinetoussaint-byte]

Superseded — closing without merging.

The #460 umbrella work landed on main as three separate PRs while this branch was being reconciled:

• feat: publish agent releases via go-github instead of gh CLI (#457) #462 — agent-release publishing → go-github (closed Migrate agent-release publishing from gh CLI to go-github API #457)
• refactor: migrate GitOps PR + chore-issue flows to go-github (#458) #463 — GitOps PR + chore-issue flows → go-github (closed Migrate GitOps PR + chore-issue flows from gh CLI to go-github API #458)
• feat: auto-create library repo via go-github in librarystore (#459) #461 — librarystore auto-create-repo → go-github (closed librarystore: auto-create library repo via go-github API (keep git for content) #459)

main now has every migrated call site off the gh CLI (verified: no gh release/pr/issue shell-outs remain in agent_release.go, versions.go, gitops/publish.go, status/release.go, librarystore/github.go), with gitops/observe.go deliberately still on gh pr view for the GraphQL-only reviewDecision. This branch is now a divergent reimplementation of that merged work — merging it would conflict with and partially revert #463/#461 — so it is closed as redundant rather than merged.