feat: GitHub App identity, new commands, and skill improvements

[eval-claude-bot]

Summary

• GitHub App setup script — one command sets up a sandboxed GitHub identity for agents (idempotent, no secrets manager dependency, wires SessionStart hook + shell profile automatically)
• Token generation script — called by the SessionStart hook to auto-refresh hourly tokens
• Human review gate — GitHub Actions workflow that blocks merge on needs-human-review labeled PRs until a human approves
• New commands: /bug (methodical investigation + fix), /fire (emergency agent handoff with context dump)
• New skill: rebase (conflict resolution with intent gathering from beads issues and PR context)
• Skill improvements ported from downstream project:
  • coordinator: needs-human-review label support
  • merge-queue: structured rebase flow with subagent fallback, label-aware categorization
  • planner: task sizing heuristics, "files to read for context", testing notes, EnterPlanMode/ExitPlanMode warning
  • reviewer-plan: task sizing checklist, integration test verification
  • work.md: GitHub issue (#<number>) and ad-hoc description handling

Test plan

• setup-github-app.sh runs idempotently (re-run skips completed steps)
• generate-github-app-token.sh generates a valid token from state file
• Human review gate workflow syntax is valid
• Skills/commands have no project-specific references

Generated with Claude Code