feat(mcp): add octobroker_commit_status_set broker-owned tool (#52)

The upstream GitHub MCP server exposes no commit-status mutation (only
the read-only get_status), so review agents cannot publish a verdict as
a status check. Add a second octobroker-owned local tool that creates a
commit status via POST /repos/{owner}/{repo}/statuses/{sha} through the
scoped GitHub App credential.

- Introduce a LOCAL_TOOLS registry; generalize the write gate, local
  dispatch, tools/list injection, and x-mcp-tools filtering to cover
  every broker-owned tool (each still requires its own explicit
  allowlist entry)
- Strict argument validation: owner/repo/sha become URL path segments
  (charset + full 40/64-hex SHA enforced), state enum, non-empty
  context, description <= 140 chars, http(s) target_url
- Fail closed: only HTTP 201 with an echoed state counts as success
- Same repository policy, write gate, in-flight cap, and fail-closed
  audit as upstream write tools; Phase 1 / writes-disabled agents are
  denied before credential resolution
- Requires 'Commit statuses: write' on the GitHub App (README updated)

Co-authored-by: chaodu-agent <chaodu-agent@users.noreply.github.com>

Author: chaodu-agent

README.md

@@ -382,26 +382,29 @@ Required GitHub App permissions (grant only what your agents' tools need):
 |-------|----------------|
 | `issue_read`, `list_issues`, `create_issue`, `add_issue_comment` | Issues: read / write |
 | `octobroker_review_minimize_comment` | Issues: write and Pull requests: write |
+| `octobroker_commit_status_set` | Commit statuses: write |
 | `pull_request_read`, `create_pull_request`, `merge_pull_request` | Pull requests: read / write |
 | `get_file_contents`, `create_or_update_file`, `push_files` | Contents: read / write |
 | `list_workflows`, `run_workflow` | Actions: read / write |
 
 
 #### octobroker-owned review tools (issue #44 MVP)
 
-When writes are enabled and an authenticated agent explicitly includes the tool in its allowlist, `tools/list` also advertises it. For example:
+When writes are enabled and an authenticated agent explicitly includes a tool in its allowlist, `tools/list` also advertises it. For example:
 
 ```toml
 [[mcp.agents]]
 id = "review-bot"
 key = "env:OCTOBROKER_REVIEW_KEY"
-tools = ["issue_read", "list_issues", "octobroker_review_minimize_comment"]
+tools = ["issue_read", "list_issues", "octobroker_review_minimize_comment", "octobroker_commit_status_set"]
 repos = ["openabdev/octobroker"]
 ```
 
-The tool accepts `owner`, `repo`, `node_id`, and a `classifier` (`ABUSE`, `DUPLICATE`, `OFF_TOPIC`, `OUTDATED`, `RESOLVED`, or `SPAM`). It supports issue and pull-request comments authored by the current GitHub App bot identity; it does not minimize human-authored comments or unsupported node types. Before mutating, it verifies both the App-bot author and the exact repository owner/name against the policy arguments, then executes GitHub's `minimizeComment` GraphQL mutation locally through octobroker's scoped GitHub App credential. The operation is not forwarded to the upstream MCP server. The call uses the same repository policy, write gate, in-flight limit, and fail-closed audit as upstream write tools. Agents that do not explicitly allowlist the name, or that have writes disabled, neither see it in `tools/list` nor can call it.
+`octobroker_review_minimize_comment` accepts `owner`, `repo`, `node_id`, and a `classifier` (`ABUSE`, `DUPLICATE`, `OFF_TOPIC`, `OUTDATED`, `RESOLVED`, or `SPAM`). It supports issue and pull-request comments authored by the current GitHub App bot identity; it does not minimize human-authored comments or unsupported node types. Before mutating, it verifies both the App-bot author and the exact repository owner/name against the policy arguments, then executes GitHub's `minimizeComment` GraphQL mutation locally through octobroker's scoped GitHub App credential. The operation is not forwarded to the upstream MCP server. The call uses the same repository policy, write gate, in-flight limit, and fail-closed audit as upstream write tools. Agents that do not explicitly allowlist the name, or that have writes disabled, neither see it in `tools/list` nor can call it.
 
-This is intentionally a narrow MVP: octobroker does not expose arbitrary GraphQL, and upstream GitHub MCP tools remain unchanged. Any future octobroker-owned tool must preserve the same explicit allowlist, repository binding, write gate, and audit requirements.
+`octobroker_commit_status_set` creates a [commit status](https://docs.github.com/en/rest/commits/statuses) — the upstream GitHub MCP server offers no commit-status mutation at all (only the read-only `get_status`), so review agents that need to publish a verdict as a status check (e.g. `context: "OpenAB PR Review"`, `state: failure`) use this broker-owned tool instead. It accepts `owner`, `repo`, a full commit `sha`, a `state` (`error`, `failure`, `pending`, or `success`), a non-empty `context`, and optional `description` (≤ 140 chars) and http(s) `target_url`. Arguments are strictly validated (the SHA and repository become URL path segments), then octobroker executes `POST /repos/{owner}/{repo}/statuses/{sha}` locally through the scoped GitHub App credential; only HTTP 201 counts as success. The same explicit allowlist, repository policy, write gate, in-flight limit, and fail-closed audit apply. Requires **Commit statuses: write** on the App.
+
+This is intentionally a narrow surface: octobroker does not expose arbitrary GraphQL or REST, and upstream GitHub MCP tools remain unchanged. Any future octobroker-owned tool must preserve the same explicit allowlist, repository binding, write gate, and audit requirements.
 
 The tool surface returned by `tools/list` shrinks to match the App's actual permissions (verified in the [#22 spike](https://github.com/openabdev/octobroker/issues/22)) — grant conservatively and expand as agents need more.