Save the agent's GitHub settings

Replaces the agent's whole settings row in one transaction and makes no release: a new session reads it at once, and a change that narrows reaches running sessions too. expected_revision is settings_revision as read (null when there was no row); another value answers 409 REVISION_CONFLICT. push_attached is optional: left out, a first save writes allow and a later save keeps the row's value. updated_by is always the caller, so the first save of an agent also fixes the rollback floor at the snapshot-reading image. Only repositories the save adds are checked against the catalog and the workspace's repository ceiling, and features it turns on against the feature ceiling (400 with reason_code). Writes a set_agent_github receipt with result.change = "settings" and the values before and after; receipt_id is null when a person's row already held them. Agent managers with a web session only; API keys are refused.

Auth: cookie session only; no scope. Idempotency-Key: ignored.