Add owner-commanded checked replies for Issues and Discussions - #498

Summary

Add /typechat reply so the owner can request one checked, conversational public response without downloading a report and issuing a second publication command.

• Preserve /typechat draft as preview-only and /typechat publish <artifact-id>:<sha256> as exact-text approval.
• Separate the public reply from the scope/readiness assessment retained in Actions summaries and artifacts.
• Keep the existing eyes acknowledgment and read-only model permissions; only target-scoped trusted writer jobs can post.
• Update the automation guide, owner cheatsheet, contributor guidance, and offline regression coverage.

Authorization and safety

/typechat reply is advance authorization for one advisory response, not approval of the exact generated wording. It does not accept work, change project scope, authorize implementation, close issues, or merge anything. The approved project-direction policy and inference budgets are unchanged.

Direct publication requires successful generation, an executed successful threat scan, sealing, freshness checks, and a sealed artifact bound to the same workflow run and original owner command. Unlike manual publication, the enclosing run need not already be completed: trusted successful upstream-stage attestations are mandatory. Writer-only reruns may reuse successful upstream stages from an earlier attempt of that same run. Manual publication still requires a completed successful producer run.

Stable per-command markers and durable intents enforce one reply across regeneration and reruns. Already-answered commands skip inference at the job level; uncertain writes block retries rather than risking duplicate comments. No synthetic pre-agent completion is seeded. The sealed response bundle advances to v2, while context and scan-binding versions remain unchanged.

Validation

• npm test from tools: 153 passed, zero failed or skipped.
• Both agentic workflows compile with pinned gh-aw v0.93.5 in strict mode: zero warnings, with no generated-file drift on repeat compilation.
• Whitespace checks and 91 local documentation links/anchors pass.
• Mocked tests execute the authored workflow scripts for Issue/draft, Discussion/draft, Issue/reply, and Discussion/reply, plus provenance, tampering, duplicate, and uncertain-write cases.
• No new dependencies or library behavior changes.

Rollout

No live reply has been triggered. After human review and merge, a new owner /typechat reply comment will authorize a public response. Verify the Issue and Discussion paths separately, including exactly one response and a no-op rerun; retain coverage of the manual draft/publish path. The successful production run on the previous revision verifies draft generation only, not this new direct mode.

Follow-up to #495. Issue #75 motivated the delivery improvement; this PR does not implement its usage-reporting feature or close that issue.