Comment commands: trigger the agent by @-mentioning it on an issue or pull request

[charlesgreen]

Today the agent has exactly two triggers: the sc:go label on an issue, and a submitted pull-request review. There is no way to ask it for anything in a comment.

Two problems with that:

1. A plain comment does nothing, and looks like it should. GitHub distinguishes a conversation comment (issue_comment) from a submitted review (pull_request_review). A reviewer who types feedback in the conversation box and presses Comment gets silence. Only Review changes → Comment or Request changes reaches the fixer. That is a real usability trap for anyone who has not read the docs.
2. There is no way to re-ask. If a run stalls, or a human wants another pass after pushing a commit themselves, the only recourse is removing and re-adding a label, which is a strange gesture for "try again".

Proposal

Add an issue_comment trigger to the caller template with a small, explicit command vocabulary addressed to the bot:

• @simplycubed-code go on an issue: same as applying sc:go.
• @simplycubed-code address on a pull request: run the fixer over the current feedback.
• @simplycubed-code review on a pull request: run the reviewer role (blocked on Wire the reviewer role into the loop #32; until then this command should not exist rather than silently doing nothing).
• @simplycubed-code help: reply with the available commands.

Requirements:

• Authorization first. issue_comment fires for any user on a public repository, so the commenter must be checked for write access before anything else happens, and before secrets are in scope. This is the same exposure as Harden secret exposure on the pull_request_review trigger #56 and must use the same pattern, not a second one.
• Ignore comments authored by the bot itself, or two agents will talk to each other.
• Only act on a comment whose body starts with the mention, so quoting a previous comment does not re-trigger.
• Acknowledge with a reaction rather than a comment, so the thread does not fill with chatter.
• The bot must not act on instructions inside the issue body or diff that merely look like commands. The trigger is the comment author's identity and the comment body, nothing else.

Acceptance

• A maintainer can type @simplycubed-code address on a pull request and get a fixer pass.
• A comment from a user without write access does nothing and starts no job.
• A bot-authored comment never triggers a run.
• The README documents the commands next to the label table, including the review-versus-comment distinction.