fix(setup): known-agent-login flag, merge method detection, truncation warnings, drop dead runChecks

[yshyn-iohk]

Summary

Implements the items from issue #55 that fall inside this PR's file boundary,
plus the documentation half of issue #54 (the security-alert rail's scoping
logic is a separate change).

Fixed (issue #55)

• Item 1: init gains --known-agent-login <login...> (repeatable),
  mirroring --reviewer. It writes knownAgentLogins to config.json and the
  printed summary now names the resulting list, since AGENTS.md calls this
  field "the easy thing to forget."
• Item 2: pr_expedite/pr_approve_dep_upgrade (pi/src/extension.ts)
  now resolve a merge method when a call omits one and autonomy: "auto" is
  given, instead of always falling through to the operations' own "merge"
  default: an explicit per-call mergeMethod still wins outright, then a new
  per-repo config.mergeMethodByRepo setting, then a best-effort read of the
  repository's own allowed merge methods via a new, optional
  GitHubGateway.getAllowedMergeMethods (implemented on OctokitGateway,
  added as an optional interface member so no existing fake gateway needs to
  grow one). A repository restricted to squash-only or rebase-only merges no
  longer 405s on every auto-merge attempt. The probe only runs when autonomy
  is "auto", so the common propose-only path gets no extra API call.
• Item 4: all three discover.mjs scripts (pr-requester, pr-reviewer,
  pr-steward), and their byte-identical .pi/taskflows copies, now warn on
  stderr when a gh call returns exactly the --limit 100 cap, since gh
  truncates silently past it with no other signal.
• Item 5: runChecks is removed from ConfigSchema (core/model.ts) and
  from the docs (docs/quick-start.md, docs/cli.md, SECURITY.md), rather
  than implemented: no non-test code path ever read it, which SECURITY.md
  already admitted. Schemas regenerated via npm run gen:schemas and
  committed. SECURITY.md keeps a short note recording the removal instead of
  silently dropping the sentence.
• Item 6: pi/src/extension.ts now memoizes the default OctokitGateway
  per process (built at most once, lazily, on first use) via a small once()
  helper, instead of the previous deps.gh ?? (() => new OctokitGateway())
  building a brand-new client, with a cold ETag cache and no cached
  authenticated login, on every single tool call. An injected deps.gh (every
  test, and any future caller with its own lifecycle) is unaffected.
• Item 7: docs/quick-start.md now says, next to captureMetadata in the
  config table, that the dashboard's Agents and Collaborators views need it on
  for per-agent attribution, and what happens without it (a single "Unknown"
  row).

Fixed (issue #54, documentation and setup half)

• Documents the permission the security-alert rail needs beyond the base
  recommended scope, Dependabot alerts: read (fine-grained) /
  security_events (classic), in SECURITY.md (new "Additional scope for
  expedition auto mode" section) and docs/quick-start.md.
• init now makes one best-effort, read-only probe of the Dependabot alerts
  endpoint (against the first --repo only, since the permission is a
  property of the token, not of any one repository) and returns an unmissable
  warning, printed to stderr surrounded by ! rules, when it cannot read that
  endpoint. The probe is best-effort by construction: any thrown error is
  treated the same as the gateway's own "cannot tell" (null) result, so a
  probe failure never fails init itself. The wording is explicit that this
  permission is unrelated to requesting, claiming, or completing a review, and
  only gates the expedition taskflows' autonomy=auto path.

Explicitly left alone

• Issue Setup and defaults gaps: init flag, merge method, silent truncation, dead config, gateway reuse #55 item 3 (the size-cap strand: expedite cannot widen past
  4000 lines for a human's own oversized dependency PR) and item 8
  (docs/taskflows.md corrections) both belong to the Silent stops: the flows stop needing a human without telling anyone #51 fix, whose files
  overlap another in-flight change. Not touched here.
• Issue autonomy=auto is inert under the documented token scope (security-alert rail) #54's rail-scoping fix (scoping the security-alert count to the
  changed packages rather than the whole repository) is explicitly out of
  scope for this PR; only the documentation and the init probe are here.
• Files outside this PR's assigned set that still mention the removed
  runChecks (docs/files-and-directories.md, docs/adr/0007-*.md,
  pi/skills/agent-review/SKILL.md, skills/orchestration.md,
  examples/config.json) were left as is; none of them break anything (zod
  strips unknown keys by default), but a follow-up doc pass could clean them
  up.
• mcp/server.ts does not expose pr_expedite/pr_approve_dep_upgrade at
  all, so the merge-method fix in this PR is scoped to the pi adapter, which
  is the only place those tools exist today.

Test plan

• Root: typecheck, typecheck:test, check:schemas, check:version,
  test (629 passed), build all green.
• -w pi: typecheck, test (30 passed), build all green.
• -w dashboard build green.
• cd docs && npm run build green.
• node --check on each edited discover.mjs.
• New tests: init --known-agent-login passthrough and summary naming,
  the security-alerts probe (warns on null, warns on a thrown error but never
  rejects, stays silent on a readable count, checks only the first repo), the
  once() memoization primitive, and merge-method resolution (repository
  probe, per-repo config precedence over the probe, explicit mergeMethod
  winning over both, and no probe at all in propose mode).

🤖 Generated with Claude Code