feat: add GitHub App coder authentication

[tylerslaton]

Summary

• add host-side GitHub credential providers for dedicated/legacy PATs and a single GitHub App installation
• keep GitHub credentials out of Daytona while supporting clone, push, and draft-PR publication
• make coder preparation, approval resumes, pushes, and PR publication replay-safe
• add strict read-only GitHub MCP filtering plus Railway, AWS, CI, and setup documentation

Why

OpenTag's coder previously placed a PAT in the Daytona environment and delegated cloning, pushing, and PR creation to sandbox commands. That could not support GitHub Apps safely, kept credentials inside the sandbox, and split one logical publish across uncoordinated writes.

Live Slack testing also exposed a nested-interrupt edge: LangGraph can replay the coder task while resuming confirm_write. The audit then found two adjacent risks: the sandbox key preferred a changing AG-UI run ID, and a successful PR publication could be repeated if its tool result replayed.

How

• PAT identity resolves once through /user; App auth validates an RSA PEM at startup, signs short-lived JWTs, serializes installation-token refresh, refreshes within five minutes of expiry, and resolves the bot noreply identity
• Daytona receives the current token only on clone, pull, and push API calls; the sandbox receives no GitHub token, App JWT, private key, credential helper, or authenticated remote
• prepare_repository verifies explicit targets and open PR heads, creates/configures the local branch, and safely reuses preparation only for the exact same request
• Daytona state is keyed to the stable parent coder task namespace, so approval resumes retain the job while later jobs in one Slack thread remain isolated
• publish_changes binds approval to the exact publish payload, pushes once, caches successful publication, and safely reconciles a lost create response only when the open draft exactly matches the approved repo, refs, commit, title, and body
• hosted GitHub MCP uses dynamic provider auth and a fail-closed read allowlist requiring readOnlyHint
• agent startup derives prompt, coder registration, graph limits, and AG-UI limits from one resolved coding-readiness decision
• GitHub App variables are preserved in Railway; AWS maps IDs as optional configuration and uses a separate optional Secrets Manager private-key secret

Validation

• pnpm check-types
• pnpm test — 231 tests passed
• (cd agent && uv run pytest) — 180 tests passed
• node node_modules/railway/dist/iac/bin.js
• prior AWS validation: pnpm --dir deployment/aws build and pnpm --dir deployment/aws test — 11 tests passed
• live Slack/GitHub App acceptance: @kite-dev prepared the requested README change, resumed the approval, pushed as copilotkit-devops-bot[bot], and opened draft PR CopilotKit/CopilotKit#6541
• independent standards and spec re-reviews: clean