pr-automation

BENIGN for purpose-capability alignment: the GitHub reads/writes, CI checks, comments, labels, rebases, and merges all fit a PR automation skill, and data flows stay within GitHub/local repo tooling. Main risk is not credential theft or exfiltration but autonomous repository actions plus transitive trust in `/pr-review` and `/pr-fix` and repo-controlled Bun tasks.