feat(agents): add separate reviewer GitHub identity (PAT)

[zbigniewsobiecki]

Summary

• Separate GitHub reviewer identity — Uses AsyncLocalStorage to transparently scope a different Octokit instance to the review agent's async context, letting the review agent submit real PR reviews under a different GitHub user than the one that created the PR
• Zero gadget changes — getClient() checks AsyncLocalStorage first, so all 9 gadget files and the entire githubClient API surface remain untouched
• Review agent improvements — Posts an initial "reviewing..." comment on the PR and includes UpdatePRComment gadget so the agent can update it with the review summary

How it works

Review agent calls withGitHubToken(reviewerToken, () => executeAgentLifecycle(...))
  → All githubClient.* calls inside that scope use the reviewer's Octokit
  → Gadgets, buildContext, syntheticCalls all transparently use reviewer identity
  → Scope auto-cleans when lifecycle completes

Changes

Area	Files	What
Config	schema.ts, projects.json	Add optional reviewerTokenEnv field; enable for niu + car-dealership
Core	client.ts	AsyncLocalStorage, withGitHubToken(), getReviewerUser(), scoped getClient()
Review agent	review.ts, review.eta	Wrap lifecycle in reviewer scope; initial comment + UpdatePRComment
Triggers	utils.ts, 4 trigger handlers	Extend isSelfAuthored() + "already reviewed" check for reviewer identity
Tests	6 test files	AsyncLocalStorage scoping, reviewer identity filtering, schema validation
Docs	.env.example	Document GITHUB_REVIEWER_TOKEN env var

Graceful fallback

• No reviewerTokenEnv configured → everything works exactly as before
• Env var not set → logs warning, falls back to main token
• getReviewerUser() API call fails → logs warning, returns null, triggers don't filter (safe default)

Test plan

• npm run typecheck — no type errors
• npm run lint — no new lint errors
• npm test — all 459 tests pass (including 8 new ones)
• CI passes on this PR

🤖 Generated with Claude Code