feat(agent): auto-assign PR opener as GitHub assignee (config + wiring)

[JSONbored]

Parent epic: #3180

Goal

Add a new modular, per-repo/global toggle (autoAssignPrOpener, default off) that attempts to set a PR's opening contributor as the GitHub assignee on PR-open, as a best-effort post-gate action.

Requirements

• New boolean setting autoAssignPrOpener following the exact type_labels_enabled template (migrations/0101_type_labels_enabled.sql, src/types.ts:730, src/db/schema.ts:90, resolver in src/db/repositories.ts:502,572,685,756,828).
• .gittensory.yml parity in src/signals/focus-manifest.ts (allowed-keys list + normalizer), same PR.
• OpenAPI schema update (npm run ui:openapi) + settings-parity check (npm run ui:openapi:settings-parity).
• New src/github/assignees.ts, mirroring src/github/labels.ts:21 (ensurePullRequestLabel) — createInstallationToken → makeInstallationOctokit → POST /repos/{owner}/{repo}/issues/{issue_number}/assignees.
• Must detect GitHub's silent-drop behavior: the assignees endpoint requires the assignee (not just the caller) to have push/triage access to the repo. External contributors almost never do, and GitHub returns 201 while silently omitting them from the response assignees array — no error. Re-read the response after the call and, if the login is missing, fall back to an @mention in a bot comment (or a contributor:<login> label) so the feature is never silently a no-op for the exact audience it targets.
• New PlannedAgentAction case wired into executeAgentMaintenanceActions (src/services/agent-action-executor.ts:195,453), invoked from maybeRunAgentMaintenance (src/queue/processors.ts:2117), under the existing best-effort .catch() at :5356-5389 so a failure/no-op never blocks the gate or public surface.

Deliverables

• Migration + schema + resolver + types + OpenAPI + .gittensory.yml parity, one PR.
• src/github/assignees.ts with silent-drop detection + comment/label fallback.
• Wired into agent-action-executor + maintenance hook.
• Unit tests covering both branches of every settings fallback (99% branch-counted patch coverage) and the assignee-silently-dropped fallback path.

Expected outcome

Owner/maintainer-authored PRs (and any contributor who already holds triage+ access) get auto-assigned to themselves on open; everyone else gets a visible bot-comment fallback instead of a silent no-op. Feature defaults OFF and is fully reversible by flipping the setting.

Out of scope

Granting collaborator access to contributors as a workaround — not part of this issue.

References

• https://docs.github.com/en/rest/issues/assignees
• https://docs.github.com/en/issues/tracking-your-work-with-issues/using-issues/assigning-issues-and-pull-requests-to-other-github-users

[linear-code]

JSO-2612