feat(github-agent): complete command router v2 - #190

Summary

• complete the @gittensory command router v2 for public issue-comment commands
• route reviewability, repo-fit, and packet commands to the right agent flows
• align the app command catalog with the GitHub command catalog where commands are public-safe

What changed

• Added a shared @gittensory command catalog covering help, preflight, blockers, duplicate-check, miner-context, next-action, reviewability, repo-fit, and packet.
• Added public-safe response sections for reviewability, repo-fit, and packet outputs.
• Routed preflight/reviewability to branch preflight, packet to PR packet generation, blockers to blocker explanation, and the remaining planning commands to next-work planning.
• Recorded command usage snapshots with hashed actor IDs and fail-open telemetry writes so usage recording cannot block GitHub replies.
• Expanded sanitizer and regression coverage for scoreability, public score estimates, private reviewability terms, wallet/hotkey/payout language, raw command leakage, and no-cache PR metadata fallbacks.

Why

Closes #140. The GitHub App had only the first command set wired; the public command surface now matches the planned router v2 behavior without leaking private scorer or maintainer-only context into public GitHub comments.

Validation

• npm run typecheck
• npm run test:unit -- test/unit/github-commands.test.ts test/unit/queue.test.ts
• npm run test:coverage
• npm run test:ci
• Codex Security diff scan: 5/5 worklist rows reviewed, no reportable findings after fixing raw actor telemetry in the usage snapshot payload.

Notes

• Audit events still keep operational actor context; product-style command usage snapshots store only hashed actor IDs.
• The packet and reviewability responses remain public-safe summaries; private scorer context stays in MCP or the control panel.