WebMCP: add fresh-making and repository targets

[erinepshovel-code]

Purpose

Make the browser WebMCP surface support the actual human/agent workflow: choose how the agent should work, choose exactly which repository is targeted, then Send one provenance-bearing handoff.

Changes

• restore fresh-making as the one explicit public procedural skill beyond msdmd + meta
• render fresh-making as a collapsible human-readable Refresh card
• render every active public repository from the site's build-time GitHub projection as a click/select target
• carry repository URL, default branch, observed exact head SHA, status, and category into tiw_human_handoff
• require skill + repository + outcome before Send
• prefill the standard make-fresh outcome when fresh-making is selected; human may edit it
• preserve page-session-only browser handoff and separate repository write authority
• keep the recently rolled-back unauthenticated remote-handoff path absent

Shared-material contract

The human sees the same canonical skill definition and exact repository identity that the browser agent receives in the handoff. No internal skill name or repository identifier must be typed.

hmmm

The repository projection observes active public GitHub repositories. It does not grant write authority, and archived/private/non-GitHub targets remain outside this public selector.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T14:11:46.806377Z	5701806	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.