[product-manager-impersonator] Quick-Setup Permission Preflight

## Feature Idea

**Summary:** Add a fail-fast permission preflight to `scripts/quick-setup.sh` that verifies secret-write, push, and PR-create capabilities before mutating branches or files.

## Why a Customer Would Want This
Teams using the one-command installer expect a smooth first run. Today, users can get late failures only after branch checkout and file writes, which creates cleanup work and confusion. A preflight would surface permission gaps immediately with clear remediation steps.

## Rough Implementation Sketch
- Add a preflight stage near auth/repo discovery in `scripts/quick-setup.sh` that checks:
- authenticated `gh` session
- ability to set repo secret (or explicit `--skip-secret` path)
- ability to push branch and create PR for target repo.
- Add optional `--preflight-only` mode for CI/docs validation.
- Fail early with specific guidance (`gh auth refresh`, required repo role/scopes, `--skip-secret` fallback).
- Document preflight behavior in setup docs and quick-setup section.

## Why It Won't Be That Hard
The quick-setup flow is centralized in one script, and all relevant operations are already performed there (`gh secret set`, `git push`, `gh pr create`). This is mostly reordering + explicit capability checks, with a small docs update.

## Evidence
- `scripts/quick-setup.sh:95-98` only checks `gh auth status` (login), not effective permissions.
- `scripts/quick-setup.sh:173-183` starts branch operations before permission-sensitive checks.
- `scripts/quick-setup.sh:248`, `scripts/quick-setup.sh:269-270` perform secret write, push, and PR creation late in the flow.
- `README.md:30-39` presents quick setup as a streamlined path that installs workflows, sets secret, pushes, and opens PR.
- `docs/index.md:37-44` sets a “commit and push — that’s it” expectation, amplifying impact of late permission failures.

> [!NOTE]
>
> 🔒 Integrity filtering filtered 80 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - [#704](https://github.com/elastic/ai-github-actions/issues/704) (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#675](https://github.com/elastic/ai-github-actions/pull/675) (`list_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#808 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#807 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#806 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#804 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#803 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#801 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#800 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#799 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#797 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#796 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#795 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#786 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#785 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#784 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - ... and 64 more items
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/23589113824)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.