Harden GitHub handle extraction and verify account exists before inviting

[ewels]

Problem

A GitHub invitation request came in where the applicant answered the handle question with a sentence:

Which is your GitHub handle?
My GitHub username is @Harshita-sriv.

The "Add to GitHub org" message shortcut parsed the answer by grabbing the first whitespace-delimited token after the prompt — My — which is a valid-looking handle, so the bot invited the real GitHub user my instead of @Harshita-sriv.

Changes

1. Smarter handle extraction (add_member_shortcut.py)

_handle_from_answer now scans the whole answer line for an unambiguous signal rather than blindly taking the first token:

• An @mention token → @Harshita-sriv ✓
• A github.com/<user> URL token
• A lone token, when the answer is a single word

Multi-word prose with no @ or URL is ambiguous, so it refuses to guess and returns None (the caller then asks the core-team member to use /nf-core github add <username>). All stripping and validation is delegated to the existing normalise_github_username.

2. Account-existence guard (invite_flow.py)

invite_and_greet now verifies the account exists (GET /users/{username}) before any invite, so typo'd or non-existent handles are rejected up front with a clear message — belt-and-braces on top of the extraction fix.

Tests

• Added extraction cases including the verbatim incident input, prose-with-URL, bare-word rejection, and @mention-only.
• Added "user does not exist → not invited" cases for both the slash command and the shortcut.
• Shared _user_exists autouse fixture lives in conftest.py.

Full suite: 425 passed. ruff check, ruff format, and mypy clean (no new errors).

🤖 Generated with Claude Code

[ewels]

For you @jfy133 ❤️