[connectors] GitHub connector — de-hardwire Coder

[serge-ivo]

[connectors] GitHub connector — de-hardwire Coder

Extract GitHub ops out of Coder-only routes into a shared GitHub connector so ANY permitted agent can use them (the concrete motivating case: GH Actions status is currently hardwired).

Evidence (hardwired today)

• Actions/deploy status: routes/coding.ts:410-448 (fetches …/actions/runs inline).
• Issues / read issue / next-issue: lib/github-issues.ts + routes/coding.ts:455-536.
• Auth: installationTokenForOwner (lib/github-app.ts:190) — reusable in code, exposed nowhere.

Do

• GitHub connector (auth: App-install, reuse installationTokenForOwner; grantModel: instance-resource = repos). Tools:
  github_workflow_runs, github_trigger_workflow, github_get_run, github_list_issues, github_read_issue, github_create_issue, github_comment_issue, github_list_prs, github_read_pr, github_create_pr, github_read_file, github_list_files.
• Coder consumes these tools/handlers instead of its hardwired logic (keep the Coder UI endpoints as thin wrappers over the connector, or migrate the console to the generic tool-call API).
• Writes (create issue/PR/comment/trigger) require the connector's write scope + consent (see the safety issue).

Acceptance

• A non-Coder agent with the GitHub connector + repo grant can read Actions status / issues.
• Coder's Actions-status + issues panels are backed by the connector, not inline fetch.
• Full suite green; no behavior regression in Coder.

Depends on the connector framework. Part of the epic.

[serge-ivo]

De-hardwired in 70b2143: the four duplicated fetch(.../actions/runs) sites (coding.ts latestRunFor, /deployment, /deployments + the github connector's github_workflow_runs) now read builds through one shared lib/github-actions.ts (fetchWorkflowRuns + mapWorkflowRun). Behaviour-identical; full api suite green (1390).