calm-hub: document the GitHub storage backend and its config surface

The GitHub storage backend (`calm.database.mode=github`) has no user-facing documentation — no explanation of the namespace-to-repo config surface (`calm.github.namespaces`, access groups, clone directory), the OAuth-adjacent config, or the read-only/SHA-versioning model it exposes.

**Fix:** add a docs page (or ADR under `calm-hub/decisions/`) covering: configuring namespaces and access groups, what read-only mode means for this backend, and how versions work (real SHAs, no semver, no `latest`).

Start with the GitHub backend configuration around calm.database.mode=github and the calm-hub/decisions/ directory to find the appropriate documentation location. Document namespace and access-group settings, clone directory and OAuth-adjacent configuration, read-only behavior, and SHA-based versioning; done means users can configure the backend and understand that it has no semver or latest versions.

Written by the indexing model from the issue text.