fix(scopes): allow public_repo scope for public repository write tools

[CAOShurong]

Summary

Fixes #3136 by lowering the required OAuth scope from repo to public_repo for the six repository write tools the issue identifies as public-repo-safe:

• add_issue_comment
• issue_write
• create_branch
• push_files
• create_pull_request
• fork_repository

An OAuth deployment that only needs to contribute to public repositories can now request least-privilege public_repo instead of the broad repo scope, which also grants private-repository access.

Why this is safe

• The scope hierarchy still lets a full repo token satisfy public_repo, so existing deployments retain access.
• GitHub continues to enforce actual repository permissions at the API layer; this only stops the tool filter from hiding operations that a public-only token can perform.
• After rebasing onto main@febc3293, push_files keeps the newer dynamic workflow-path policy: ordinary files require public_repo, while .github/workflows/* additionally challenges for workflow.

Testing

Exact head: 660bd4f1

• go build ./... — pass
• go vet ./pkg/github/ ./pkg/scopes/ — pass
• Targeted public-repo, dynamic-scope, and workflow-path tests — pass
• go test ./pkg/scopes -count=1 — pass
• Full go test ./pkg/github/ -count=1 has the same six Windows icon-order snapshot failures on pristine main@febc3293 and this branch; the branch adds no failure.

AI assistance disclosure: Codex assisted with the rebase, conflict adaptation, tests, and drafting; I verified the resulting diff and reported results and take responsibility for the contribution.

[CAOShurong]

Rebased onto current main as 660bd4f1 and resolved the scope-API drift. The update also preserves the newer dynamic workflow challenge for push_files: normal files now need public_repo; workflow files need public_repo + workflow. Targeted tests, build, and vet pass, and the full-package failure set matches pristine main exactly. Ready for review.

AI assistance disclosure: Codex assisted with the rebase and verification; I checked the resulting diff and results.