feat(github): add label-triggered GitHub Issues task channel

## Component

CDK GitHub adapter, webhook processing, CLI, docs

## Describe the feature

ABCA should accept coding tasks directly from GitHub Issues: when a configured GitHub issue receives the trigger label, ABCA creates a task for the mapped repo and opens a PR, matching the baseline Linear/Jira issue-tracker flow.

This should reuse the existing `/v1/github/webhook` endpoint and GitHub webhook signature verification. Today that endpoint only handles `deployment_status` events for preview screenshots and silently ignores `issues` events.

## Use case

Teams that already manage work in GitHub Issues should not need Linear, Jira, Slack, or the CLI to hand a ticket to ABCA. The expected workflow is:

1. Create or edit a GitHub issue.
2. Add the trigger label, default `bgagent`.
3. ABCA picks up the issue, creates a task, and opens a PR for the mapped repo.

## Proposed solution

Add a GitHub Issues adapter alongside Linear/Jira, with GitHub-specific simplifications:

- Extend the existing GitHub webhook receiver to dispatch `X-GitHub-Event: issues` while preserving current `deployment_status` screenshot behavior.
- Reuse `X-Hub-Signature-256` verification and do not add a second GitHub webhook route or signature path.
- Add `github` as a `ChannelSource` in CDK/CLI shared types.
- Add a GitHub issue processor for `action: "opened"` when the issue already has the trigger label, and `action: "labeled"` when the added label matches the configured trigger label.
- Add a repo mapping model from GitHub issue repo to ABCA target repo, defaulting to identity mapping when appropriate.
- Add `bgagent github map [target-repo]` and update existing GitHub webhook setup help to mention the `issues` webhook event.
- Create tasks with `workflow_ref: "coding/new-task-v1"` and GitHub channel metadata such as owner, repo, issue number, issue node id, and issue URL.
- Use the existing GitHub App/PAT token path; do not introduce a separate GitHub OAuth app or MCP server.

## Acceptance criteria

- A signed GitHub `issues.opened` payload with the trigger label creates one ABCA task.
- A signed GitHub `issues.labeled` payload creates one ABCA task when the added label matches the configured trigger label.
- Unlabeled issues, unrelated labels, unsupported GitHub events, and bot-origin events are safe no-ops.
- Existing `deployment_status` screenshot behavior still works.
- Duplicate webhook deliveries do not create duplicate tasks.
- The created task has `channel_source: "github"` and enough metadata for comments, final status fanout, and later orchestration features.
- Repo mapping supports identity default and explicit target repo override.
- Docs explain required GitHub App/webhook permissions, especially `Issues: Read & write` and the `issues` event.

## Tests

- GitHub webhook tests cover `deployment_status` unchanged, `issues` dispatch, signature failure, and duplicate delivery.
- GitHub issues processor tests cover opened-with-label, labeled-action, wrong label, missing mapping, unmapped user, bot-origin skip, and task payload construction.
- CLI tests cover `bgagent github map`.
- Docs add a GitHub Issues setup guide or extend existing GitHub webhook docs.

## Out of scope

- GitHub user invite/link flow; tracked separately.
- Final status/cost comments; tracked separately.
- `bgagent:decompose`, `bgagent:auto`, and orchestration labels.
- GitHub Projects automation.
- GitHub Enterprise Server support.
- PR/review-native triggers; covered by existing orchestration trigger work.