feat(docker): install gh CLI + add GH_TOKEN/git identity env vars

Add github-cli (gh) to the runtime image so the agent can clone, open PRs,
and cut releases. Document GH_TOKEN (auto-used by gh) and the
GIT_AUTHOR_*/GIT_COMMITTER_* commit-identity vars in .env.example, with a note
to run `gh auth setup-git` for git push/clone over HTTPS.

Verified: image builds with github-cli 2.83.0; `gh --version` works.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jkyberneees

docker/.env.example

@@ -22,6 +22,23 @@ ODEK_BASE_URL=https://api.deepseek.com/v1
 # the "running without --sandbox" startup warning that run/repl print.
 ODEK_SUPPRESS_SANDBOX_WARNING=1
 
+# ── GitHub CLI (gh) + git identity ───────────────────────────────────────
+# gh reads GH_TOKEN automatically — no `gh auth login` needed. Use a personal
+# access token (classic or fine-grained) with the scopes you need, e.g. repo,
+# read:org, workflow.
+GH_TOKEN=ghp_your_personal_access_token
+
+# Commit identity. git uses these env vars directly, so no `git config` is
+# required for the agent's commits to be attributed correctly.
+GIT_AUTHOR_NAME=Your Name
+GIT_AUTHOR_EMAIL=you@example.com
+GIT_COMMITTER_NAME=Your Name
+GIT_COMMITTER_EMAIL=you@example.com
+#
+# `gh` commands (gh repo clone, gh pr, gh release, …) work out of the box with
+# GH_TOKEN. For plain `git push`/clone over HTTPS, have the bot run once:
+#   gh auth setup-git      # registers gh as git's credential helper via GH_TOKEN
+
 # ── Telegram bot (only for the telegram-* profiles) ──────────────────────
 # Get a token from @BotFather; restrict to YOUR chat/user id.
 # ODEK_TELEGRAM_BOT_TOKEN=123456:ABC-your-bot-token

docker/Dockerfile

@@ -18,8 +18,9 @@ RUN CGO_ENABLED=0 go build -ldflags "-s -w" -o /out/odek ./cmd/odek
 # ---- runtime stage ----
 FROM alpine:latest
 # Tooling the agent commonly needs inside the sandbox container.
-# Trim or extend this list to taste. (git is already included here.)
-RUN apk add --no-cache ca-certificates git bash coreutils curl jq
+# Trim or extend this list to taste. git + the GitHub CLI (`gh`, from the
+# Alpine community repo) are included so the agent can clone/PR/release.
+RUN apk add --no-cache ca-certificates git github-cli bash coreutils curl jq
 
 # ── Adding extra dependencies the agent can use ──────────────────────────
 # The agent runs shell commands INSIDE this image, so any runtime or CLI it