feat(github): add owner-scoped aggregation with optional token auth

[CrisSTEM]

Summary

Add owner-scoped GitHub aggregation for bindings that use scope.owner and scope.owner_type.

The GitHub fetcher now lists public repositories for organization/user owners, aggregates owner-level snapshots across those repositories, and uses GITHUB_TOKEN when present to improve rate-limit headroom. The PR also documents current archived/fork behavior and keeps owner-scoped github.contributors explicitly deferred.

Linked issue(s)

• Closes feat(github): add owner-scoped GitHub aggregation with optional token auth #30

Milestone fit

This advances v0.3.0 by covering the generic GitHub owner aggregation path needed by the demo/runtime. Scheduler work, advanced retry/caching, and owner-scoped contributors remain intentionally out of scope.

What changed

• Added owner-scoped GitHub binding execution using owner and owner_type
• Added public repository listing and pagination for organization and user owners
• Added optional token auth via GITHUB_TOKEN for GitHub API requests
• Added deterministic tests for owner aggregation, pagination, and token auth
• Documented unauthenticated behavior, rate-limit exposure, and current archived/fork inclusion
• Rejected ambiguous GitHub bindings that mix repos with owner / owner_type

Out of scope

• owner-scoped github.contributors
• scheduler integration
• advanced caching/retry systems

Validation

Mark what you actually ran:

• python3 ./scripts/trim-whitespace.py --check
• go vet ./...
• go test ./...
• make ci
• Manual CLI verification was performed if runtime behavior changed

Documentation impact

• No docs update needed
• README.md
• SPEC.md
• docs/
• repository governance docs (AGENTS.md, CONTRIBUTING.md)
• CHANGELOG.md
• release notes

Reviewer focus

• internal/fetch/github.go for owner-scope parsing, owner repository listing, aggregation, and optional token auth
• internal/fetch/github_test.go for deterministic coverage of aggregation and pagination
• internal/config/validator.go for mixed repo/owner scope rejection
• docs/configuration.md and docs/reference-dataset.md for archived/fork/rate-limit documentation

Auditability checklist

• Branch name follows project convention
• PR scope matches the linked issue and milestone
• Commits were pushed progressively, not as one final dump
• Relevant tests were added or updated for behavior changes
• No secrets or sensitive credentials were introduced
• Deferred follow-up work is documented explicitly
• Unimplemented work is not implied as completed

Notes for merge

Preferred merge method:

• Issue PRs: Rebase and merge