feat(github): add user linking for GitHub issue-trigger attribution

## Component

CDK GitHub adapter, CLI, identity mapping

## Describe the feature

GitHub issue-triggered tasks need explicit user attribution like Linear and Jira. A GitHub issue author or labeler should map to a Cognito platform user so ABCA can enforce per-user concurrency, cost attribution, and auditability.

## Use case

Without a user mapping, all GitHub issue-triggered tasks would need either a shared fallback user or would be unattributed. That is weaker than Linear/Jira and makes cost/concurrency controls harder to reason about.

## Proposed solution

Add a GitHub user mapping flow modeled after Linear/Jira invite/link:

- Add a GitHub user mapping table keyed by GitHub login or node id.
- Add an admin command such as `bgagent github invite-user ` that resolves the GitHub identity and emits a one-time link code.
- Add `bgagent github link ` for a Cognito-authenticated teammate to confirm and bind the GitHub identity to their platform user.
- Add a Cognito-authenticated `POST /v1/github/link` route if the existing link API pattern requires it.
- Have the GitHub issue processor attribute tasks to the mapped GitHub sender or issue author, using a clear precedence documented in tests.
- If no mapping exists, reject task creation with a clear GitHub issue comment rather than running under a silent fallback identity.

- Per-user GitHub OAuth tokens.
- Replacing the existing GitHub App/PAT credential path.
- Organization-wide fallback users.
- GitHub Enterprise Server identity mapping.

Start by tracing the existing Linear/Jira invite and link flows, then inspect the GitHub issue processor and the CLI and handler test areas mentioned in the issue. Done means admins can create one-time codes, teammates can confirm identities, mapped users receive attribution, unmapped users receive a clear comment without task creation, and existing mappings remain unaffected.

Written by the indexing model from the issue text.