feat(studio): GitHub as roadmap source — Revisão column + PR refs (CS-76 phase B)

[RudneyForti]

Summary

Phase B of CS-76: GitHub becomes the source of truth for the git-owned side of the roadmap. The done archive is read live from origin/main and a new Revisão column is projected from open PRs — both locked. The local file becomes an offline fallback (amber stale banner).

Changes

• lib/roadmap-github.ts: board from main + open PRs via GitHub API; 60s cache, 30s negative cache, 8s timeout; every failure degrades to the file fallback
• assembleBoard v2 (pure, tested): precedence main > open PR > local; a CS with an open PR projects its local card into Revisão (or synthesizes one from the PR title)
• Annotation satellites (decision "a"): local Postgres rows survive promotion; their checklist/comments are spliced read-only onto the locked git card
• prNumber: stamped by the roadmap-sync Action on merge; rendered as a #NN link to the PR on the card
• Promotion: roadmap-sync now creates the git card when it's missing — locally-planned (Postgres) cards enter git at merge, closing the no-op gap seen on PR feat(studio): dual-source roadmap — local Postgres layer (CS-76 phase A) #36
• UI: origin chips (🔵 local / 🟢 github), violet Revisão column, offline banner, add/drag/column-select restricted to local columns
• Compose: optional GITHUB_TOKEN pass-through (repo is public — token only raises the rate limit)
• Guard: refuse to prune the local layer on a malformed empty-board payload

Live self-test

This PR itself should appear in the Revisão column of the Studio board while it is open — the feature demonstrating itself.

Checklist

• Link to feature/issue: CS-76
• Description of changes included above
• List of additions documented
• All existing tests are passing (101)
• New tests were added for this change (assembleBoard v2, resolveCsNumber, negative cache path, stale flag)
• Agent Smith validated behavior (browser: Revisão column, origin chips, live GitHub read, no stale banner)
• No regressions observed

References

CS-76 (phase B of 3 — phase C: server-side enforcement + AGENTS.md update)