#1038 fix(github): distinguish API throttling from token permissions

• GitHub can return403 for primary or secondary rate limiting. The reporter treated every403 as a read-only token and recommended changing permissions.
• Identify documented throttling signals and429, name the actual cause and tell the user to wait before rerunning. Keep ordinary401/403/404 credential diagnostics and stop after the failed request.

Protocol reference: GitHub rate-limit docs.

Verified

Ran it locally: yes.

Ran actual fetch requests against a local HTTP server for primary403, Retry-After403, secondary403 and429. Asserted throttling diagnostics, no permission advice and exactly one request. Existing comment protocol and reporter tests pass; no request was sent to live GitHub.

main	this branch
Regression fails	Regression and adjacent tests pass

RUN  v5.0.1 packages/github


 Test Files  2 passed (2)
      Tests  21 passed (21)
   Start at  09:56:15
   Duration  430ms (transform 57%, import 29%, tests 13%, worker 1%)

The full repository pnpm check, changed package build, typecheck, and changed TypeScript lint pass. The full repository pnpm check passes on the pinned unchanged base with the complete frozen-lockfile install. Browser and mobile benchmark suites were not run; no live model calls were made.