Add portable GitHub session resources

[heimanba]

What changed

• add provider-neutral GitHub repository resources to managed Agent Sessions
• map repository resources to Qoder and Claude wire formats, including provider-specific URL and mount-path rules
• derive /data/workspace/<repo> for Qoder and /workspace/<repo> for Claude when mount_path is omitted
• centralize mount roots for Qoder (/data), Claude (/workspace), Bailian (/mnt), and Ark (/mnt)
• reject mismatched absolute mount paths while resolving relative file paths under the provider root
• default every enabled builtin tool to always_allow, with case/separator-insensitive explicit permission overrides
• validate unsupported provider features before runtime and preserve tool permissions during sync
• add Qoder and Claude GitHub Session examples and configuration documentation

Why

Managed Session repository resources previously had no portable declaration or shared provider mapping. Tool permission defaults and mount paths were also implemented inconsistently across adapters, which could silently drop resources or produce paths that the target runtime could not materialize.

Impact

Users can declare a private GitHub repository once on an Agent and run it through Qoder or Claude. Provider-specific constraints remain explicit: Qoder paths live under /data, Claude paths under /workspace, and unsupported providers fail validation rather than degrading silently.

Validation

• full pre-push verification profile passed: typecheck, architecture checks, all workspace tests, and changed-file lint
• SDK suite: 618 passing tests
• provider documentation and open-source invariant tests passed
• Qoder real API Session creation confirmed /data/workspace/heimanba.github.io in the resource response after adapter mapping
• Claude real API Session creation confirmed repository resource creation and .git URL normalization
• secret scan and git diff --check passed

Follow-up observation

The tested Qoder self-hosted/BYOC environment accepted and returned the corrected /data/workspace/... resource metadata, but the repository was not visible inside that container. The client-side wire contract is covered here; the remaining BYOC materialization behavior requires provider-environment confirmation.