feat(agent): promote project/milestone matching to auto-apply mode

[JSONbored]

Parent epic: #3180

Goal

Once suggest-mode (#3183 and #3184) has run long enough in production to validate the false-positive rate, allow repos to opt into autoProjectMilestoneMatch: "auto", which actually calls attachToMilestone/attachToProject instead of only commenting.

Requirements

• Gate this behind the tri-state config value already shipped earlier in this epic — no new migration needed for the enum itself, just wire the "auto" branch.
• Add a per-repo confidence-threshold override (autoProjectMilestoneMatchThreshold) so a maintainer can tighten matching before turning on auto-apply.
• Auto-apply must remain best-effort / never block the gate, same pattern as the rest of the maintenance step (src/queue/processors.ts:5356-5389).
• Document the observed suggest-mode false-positive rate (from production data gathered by feat(agent): auto-match PRs to open GitHub Milestones (suggest-mode) #3183 and feat(agent): auto-match PRs to open GitHub Projects v2 (suggest-mode) #3184) in the PR description as the basis for the default threshold.

Deliverables

• Wire the "auto" branch to call attachToMilestone/attachToProject.
• Threshold override setting + .gittensory.yml parity + OpenAPI.
• Tests: auto-apply success, auto-apply failure (best-effort no-block), threshold override respected.

Expected outcome

Repos with validated-low false-positive rates can fully automate project/milestone tracking for PRs with no explicit issue link.

Blocked by

#3183 and #3184 must ship and run in suggest-mode first — this issue should not start until there's real false-positive data to set a default threshold from.

[linear-code]

JSO-2615