feat(cdk): add github:* resource tagging strategy

[scottschreckengaust]

Summary

• Applies 9 github:* tags to all stack resources via Tags.of(stack).add() in main.ts
• Tags are injected through CDK context (-c github:sha=..., etc.) and default to sentinel none
• Ensures consistent tag schema across all stacks for cleanup harvesting and CI/CD provenance

Closes #84

Tags

Tag key	CI variable	gh / git CLI	Default
github:sha	$GITHUB_SHA	gh api /repos/{owner}/{repo}/commits/{ref} --jq .sha / git rev-parse HEAD	none
github:ref	$GITHUB_REF_NAME	gh api /repos/{owner}/{repo}/git/ref/heads/{branch} --jq .ref / git branch --show-current	none
github:ref-type	$GITHUB_REF_TYPE	gh api /repos/{owner}/{repo}/git/ref/heads/{branch} → branch or /tags/{tag} → tag / git cat-file -t $(git rev-parse HEAD)	none
github:actor	$GITHUB_ACTOR	gh api /user --jq .login / git config user.name	none
github:head-ref	$GITHUB_HEAD_REF	gh pr view --json headRefName --jq .headRefName / none (only in PR context)	none
github:run-id	$GITHUB_RUN_ID	gh run list --limit 1 --json databaseId --jq '.[0].databaseId' / N/A (CI only)	none
github:event	$GITHUB_EVENT_NAME	gh run view {run-id} --json event --jq .event / N/A (CI only)	none
github:repository	$GITHUB_REPOSITORY	gh repo view --json nameWithOwner --jq .nameWithOwner / git remote get-url origin	none
github:clean	true (CI always clean)	N/A / [ -z "$(git status --porcelain)" ] && echo true || echo false	none

Test plan

• 3 new tests in cdk/test/stacks/github-tags.test.ts
  • All 9 tags default to none when no context provided
  • Tags reflect context values when provided
  • Empty string values resolve to none
• All 38 existing agent.test.ts tests pass unchanged
• TypeScript compiles cleanly

🤖 Generated with Claude Code