feat(discord): add native task controls and GitHub work queue

[SebastianBoehler]

Summary

• add native Discord task cards, commands, retry/continue controls, explicit failure details, and automatic threads for substantial work
• passively mirror GitHub issues and pull requests into the configured review channel with Review, Security review, Vulnerability scan, and Work on this actions
• bind every GitHub action to a typed intent and exact persisted commit, reuse one item thread, and fail closed on stale cards or stale worktrees
• run restricted actions through Codex app-server permission profiles with no network, no inherited gateway environment, and denied credential/secret paths
• keep GitHub intake passive: these Discord actions do not post reviews, comments, labels, or other GitHub mutations

Verification

• ruff check .
• strict pyright (0 errors, 0 warnings)
• pytest -q (497 passed)
• fresh ARM64 Docker image build
• container imports and codex-cli 0.144.1 smoke checks
• real Codex app-server thread startup in the image for both security-review and implementation permission profiles

Deployment

Pending test deployment: the course Jetson currently times out on SSH before authentication. The current production bot remains on the previous image with automatic PR review disabled.