feat: add bounded issue-to-PR workflows

[RedStar071]

Deliver the v0.4 milestone: a scoped, labeled GitHub issue can become an investigated, implemented, verified, review-ready pull request without widening the runtime's authority.

• shared: add the issue trigger, IssueRef, and acceptance criteria to the decision, result, and evidence contracts; render criteria in reports
• config: add the issues policy (enabled, requireLabel, branchPrefix) with branch-prefix validation; issue work is opt-in twice
• models: let the model record verifiable acceptance criteria and treat issue text as an untrusted change request
• agent: bound model-authored criteria before they become evidence and require an isolated runner for issue-triggered fixes when configured
• github: parse issues webhooks behind the required label, build runtime input with observe as the default mode, and publish verified changes through the Git data API on a fresh branch that is never force-updated; prepareIssuePullRequest is the single publication gate and refuses any run that is not completed, accepted, and verified, or that proposes a high-impact change
• server: ingest issues events behind repository policy, and compose the publication from stored evidence through a read-only runner; a failed publication reports its reason instead of failing the run

Verification: aube run check:repo, oxfmt --check, type-aware oxlint and tsc on every changed package, and 333 vitest tests across shared, config, models, agent, github, runner, cli, auth, and server all pass locally.

Closes#11

Claude-Session: https://claude.ai/code/session_01B4XhMKBtf98NZZmETE1XR4

Summary

Why

Verification

• aube run check:repo
• aube run lint:ci
• aube run typecheck
• aube test
• aube run build

Safety and compatibility

• I added or updated deterministic tests for changed behavior.
• I preserved observe mode as read-only, or explained the policy change above.
• Runtime commands and target-repository writes remain inside the runner boundary.
• I did not expose secrets, tokens, personal data, or untrusted output in logs.
• I updated documentation and Agent Skills when workflows or boundaries changed.

Reviewer notes

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Confidence Score: 5/5

No blocking failure remains.

No accepted blocking findings remain after executable checks exercised the previously reported publication, repository-binding, delivery-claim, and remote-origin paths.

T-Rex Logs

What T-Rex did

• Ran a focused server publication regression using a focused test command and observed two tests pass with exit code 0; the first test captured invalid UTF-8 bytes and a deletion in the verified snapshot, mutated the live checkout, and the GitHub blob request contained the original exact base64 payload while the tree showed the deletion with sha: null; the second test bound the checkout to donor/library and caused openIssuePullRequest to refuse publication with no GitHub requests; a broader regression command covering apps/server and router tests produced 48 passing tests with exit code 0.
• Ran the focused webhook idempotency regression, exercising 32 concurrent claims with an atomic store, 32 adversarial concurrent claims via the fallback arbitration path, a replay through a fresh persistent-store instance, and production route injection; all four checks passed, and existing delivery-claim and router tests passed 53 checks, with the server typecheck and production route build completing successfully.
• Created an executable probe that builds temporary Git repositories and exercises LocalRunner.originRepository against real HTTPS and SCP origin metadata; attacker origins returned null while github.com origins returned the expected acme/app identity; the focused runner suite passed all 46 tests.
• Observed that pnpm commands were captured as the before condition and failed because the repository is configured for aube; after switching to direct installed-tool invocations, the focused regression passed 4/4, existing server regressions passed 53/53, and the TypeScript typecheck and production route build completed successfully.
• Implemented the remote-host-binding probe and captured non-GitHub runtime output, GitHub-origin comparison runtime output, and a runner-origin regression test run; the artifacts include the probe source and the corresponding before/after logs and the runner-origin test log.

_{Ran code and verified through T-Rex}

_{Reviews (7): Last reviewed commit: "fix(server): arbitrate fallback delivery..." | Re-trigger Greptile}