feat: manage GitHub infrastructure declaratively

[davejohnson]

Summary

• add a typed github desired-state model for checks, autofix, pull-request review, code audit, dependencies, security, and collaboration
• deliver managed workflow/config files through one deduplicated reviewable infrastructure PR, then converge native settings and the OpenAI Actions secret in later plan/apply stages
• replace imperative hv_ci_setup mutations with a one-release desired-state compatibility bridge while retaining hv_ci_status and hv_ci_trigger
• surface optional GitHub infrastructure and connection guidance in the macOS companion and beginner documentation
• harden autofix with same-repository/target-branch gating, draft-only PRs, protected paths, separate secret-free validation, and no automatic merge/deploy

Verification

• npm test — 111 files, 924 tests passed
• npm run typecheck
• npm run build
• swift test — 31 tests passed
• parsed all 6 generated YAML files with Ruby YAML
• npm run prepublish-check
• git diff --check