epic(connection): deliver supervised GitHub Pilot

## Purpose

协调 Connection 侧受监督 GitHub Pilot 的 review-sized 交付。该总票保持开放，直到 10 张原生 sub-issues 全部完成；它不是 primary Implementation Issue 或 PR target，也不授予任何执行权限。

路线与范围由 [wayfinder: 形成 Connection M1 启动与落地路线](https://github.com/AgoraIO-Extensions/agent-infra/issues/152)及其已关闭决策票确定，实施拆分决议见 [确定 Connection M1 实施 Issue DAG 与并行交付边界](https://github.com/AgoraIO-Extensions/agent-infra/issues/156)。

## Native sub-issues and merge order

1. [docs(connection): align M1 authority contracts to Wayfinder decisions](https://github.com/AgoraIO-Extensions/agent-infra/issues/393)
2. [feat(connection): publish Pilot browser catalog and invocation contracts](https://github.com/AgoraIO-Extensions/agent-infra/issues/398)
3. [feat(connection): establish PostgreSQL authority and domain core](https://github.com/AgoraIO-Extensions/agent-infra/issues/399)
4. [feat(connection): implement LDAP principals and browser sessions](https://github.com/AgoraIO-Extensions/agent-infra/issues/390)
5. [feat(connection): constrain GitHub Pilot provider and repository policy](https://github.com/AgoraIO-Extensions/agent-infra/issues/396)
6. [feat(connection): expose authenticated read-only catalog API](https://github.com/AgoraIO-Extensions/agent-infra/issues/394)
7. [feat(connection): deliver GitHub connection and grant management web](https://github.com/AgoraIO-Extensions/agent-infra/issues/397)
8. [feat(connection): verify delegated assertions and actor bindings](https://github.com/AgoraIO-Extensions/agent-infra/issues/391)
9. [feat(connection): execute reliable effects and revoke provider tokens](https://github.com/AgoraIO-Extensions/agent-infra/issues/392)
10. [build(connection): assemble GitHub Pilot runtime and HCI readiness](https://github.com/AgoraIO-Extensions/agent-infra/issues/395)

每张子票有独立 Owner、primary Issue、分支、PR、稳定 AC 和 Validation。GitHub 原生依赖是执行图权威，子票正文 `## Blocked by` 只投影原生关系；列表顺序不覆盖 DAG。

## Coordination acceptance criteria

- [ ] 10 张 sub-issues 均通过独立 PR 完成，且其权威正文依赖与 GitHub 原生依赖保持一致。
- [ ] 所有交付均从最新 `main` 创建短期分支并直接回到 `main`，不建立长期 Connection 集成分支。
- [ ] GitHub Pilot runtime 只包含三项 GitHub Action 和受控 private repository policy，不包含 Direct MCP、PAT、Bitbucket、Jira 或 Confluence。
- [ ] Connection-side readiness 由固定 `main` commit 和镜像 digest 证明，并明确移交给跨地图真实 Pilot 汇合票。
- [ ] 历史分支、tag、开放 PR 和旧 HCI Issue 只在替代内容合入后关闭，不整体合入或删除证据。

## Out of scope

- 本总票不直接修改代码、文档或部署，不作为 PR primary Issue，也不添加 `ready-for-agent` 或 `ready-for-human`。
- Platform Tool Gateway、Platform Fake readiness 和 Alice/Bob 跨系统真实 GitHub Pilot 继续由既有 Platform Issues 与跨地图汇合票负责。
- Bitbucket、Jira、Confluence 和其他 Provider 留待独立 onboarding 路线。

## Blocked by

None