feat: support GitHub repository questions

[RobertTLange]

What changed

• Add ask --repo <owner/name|github-url> [--repo-ref <ref>] <question> for GitHub repository Q&A.
• Clone/fetch repositories into the ask cache, materialize a temporary read-only full worktree, remove .git, and run Headless against that staged workspace.
• Add repo-specific prompts, ASK_CONTEXT.md, metadata, human/JSON output, docs, and changelog coverage.

Why

This lets ask answer questions about a repository directly, not only installed local CLI package context.

How to test

• npm test
• npm run build
• Manual smoke: ask --agent none --keep-workspace --repo RobertTLange/ask-cli --repo-ref main "Where is the CLI argument parser implemented?"

Notes

The companion Headless change for structured --print-command --json identity metadata has been pushed to RobertTLange/headless-cli main.

[RobertTLange]

Review fixes applied.

Findings fixed:

• Symlink permission traversal in repository checkout: switched permission walks to lstat() and skip symlinks so untrusted repo symlinks cannot chmod targets outside the temp workspace. Commit: f59dbd3.
• Invalid --repo input escaped structured error handling: moved repository normalization inside the GitRepositoryError catch scope so CLI returns a resolution error instead of an uncaught stack trace. Commit: 8d725d6.

Validation:

• npm run build && node scripts/test.js checkoutGitRepository passed after the symlink fix.
• npm run build && node scripts/test.js "unsupported repository input" passed after the error-mapping fix.
• Final npm test passed: 142/142 tests.

No GitHub review threads existed, so this is a PR-level summary rather than per-thread replies/resolution.