feat(github): add MINT_REPO_TOKEN repo-scoped token tool

[tlgimenes]

Adds a MINT_REPO_TOKEN tool to the GitHub MCP that mints a GitHub App installation access token scoped to a single repository with least-privilege permissions, so an imported agent (e.g. in Deco Studio) can touch only its own repo. Minting is gated on the caller's own GitHub entitlement (GET /user/installations + /repositories) and uses repository_ids (rename-proof); requested permissions are capped to a repo-content/PR/issue allowlist, and the minted token is never logged or echoed (401/403 surface a generic config error). It also refactors github-app-auth to share a mintInstallationAccessToken primitive (reused by getAppInstallationToken) and classifies transient GitHub failures (5xx / 429 / 403 rate-limit) as a retryable error rather than a hard authorization denial. Output fields are exactly token, expiresAt, permissions, repository:{owner,name}, installationId, and the change is covered by 37 new tests (all green).

🤖 Generated with Claude Code

---

Summary by cubic

Adds a new MINT_REPO_TOKEN tool that mints a short-lived, repo-scoped GitHub App token with least-privilege, gated by the caller’s own GitHub access. Also fixes CI typecheck by correcting a context cast and updating @decocms/runtime in github-repo-reports.

• New Features

  • Private MINT_REPO_TOKEN tool that mints a token for exactly one repository using repository_ids, gated via GET /user/installations and /repositories (case-insensitive) and resolving the numeric repo id.
  • Permissions capped to an allowlist: contents, metadata, pull_requests, issues (defaults: contents:write, metadata:read, pull_requests:write). Output: token, expiresAt, permissions, repository {owner, name}, installationId. Token is never logged. Also introduced mintInstallationAccessToken (reused by getAppInstallationToken) and exported createAppJWT; transient 5xx/429/403 rate-limit are treated as retryable and 401/403 as config errors.

• Bug Fixes

  • Fixed typecheck by casting ctx to { env: Env } in github/server/lib/mcp-proxy.ts (no behavior change).
  • Bumped @decocms/runtime to ^1.6.0 in github-repo-reports to resolve TypeScript issues.

^{Written for commit 195eac1. Summary will update on new commits.}