feat(tools): READONLY_TOOLS filter + GitHub issue/PR pre-fetch (#193 PR 1/3)

[Abernaughty]

Summary

Foundation PR (1 of 3) for #193 — read-only GitHub + filesystem tool access for the Planner and Architect.

• READONLY_TOOLS frozenset in mcp_bridge.py naming the tools safe for read-only agents (filesystem_read, filesystem_list, github_read_diff). Excludes every write path.

• Optional tool_filter param on get_tools() / aget_tools() so the Planner (and future Architect Phase 2) can request just the allowlisted tools.

• New src/tools/github_fetch.py — standalone httpx-based fetcher for GitHub issues/PRs (the REST /issues/{n} endpoint covers both), with title + labels + body summaries, 2000-char per-ref cap, and best-effort failure handling.

• extract_github_refs() with two regex patterns:

  • cross-repo owner/repo#N — matched without a qualifying word
  • same-repo <qualifier> #N — requires issue, fix(es|ed), close(s|d), resolve(s|d), ref(s), see, review, address, gh, pr, pull(s), pull request

  Bare #N is rejected to avoid false matches on markdown headings, CSS colors, etc. Capped at 5 refs per task description.

• gather_context_node now runs the pre-fetch after file gathering and injects results into gathered_context with source: "github_issue", so the Architect sees issue bodies without calling tools.

Test plan

• uv run ruff check src/ tests/ — clean
• uv run pytest tests/ -q -m "not integration" — 1074 passed, 1 pre-existing failure in test_workspace.py::TestFromEnv::test_from_env_defaults (unrelated; reproducible on main)
• New unit tests (72 new assertions):
  • test_github_fetch.py — pattern matching, issue fetch, best-effort fallback
  • test_mcp_tools.py::TestToolFilter — read/write partitioning, async variant
  • test_gather_context.py — end-to-end pre-fetch integration

Follow-ups

This PR is deliberately scoped to shared plumbing. The agent wiring comes next:

• PR 2 — Planner: conditional tool binding on #N refs, TaskSpec.github_context pass-through, provider lifecycle.
• PR 3 — Architect: two-phase (no-tools first, tools on insufficient context) + integration test for the "Fix issue bug: Terminal panel drag-to-resize breaks after ~1/3 screen height #113" flow.

Refs #193

🤖 Generated with Claude Code