feat(conduit): capture GitHub commits + PRs (remote work the git source can't see)

[elhoim]

Problem

Conduit's git source only sees commits in a local git log. A lot of real work never lands there:

• PRs opened with gh or the web
• commits made through the GitHub API / web editor
• work done on a different machine

None of it shows up in the daily record or in the hourly BuildInsight read, so someone who spent the day shipping pull requests sees an empty or misleading Conduit. (Concretely: a day of 28 PRs rendered as "no activity" because not one was a local commit.)

Fix — a github source

A new adapter (Conduit/adapters/github.ts) captures your own commit + PR activity straight from GitHub's per-user event feed (/users/{login}/events), so remote/API work is reflected too.

• Auth is delegated entirely to the gh CLI — no tokens handled in-tree. gh already honors GH_CONFIG_DIR.
• Opt-in and off by default (sources.github = false), so existing installs are unaffected until enabled.
• Same robustness contract as the git adapter: one-shot, fault-isolated, cursor-guarded — a failed feed read emits nothing and does not advance the cursor, so no window is skipped; commit overlap with the local git source is de-duped by SHA at rollup.
• Config knobs, all optional with sane public defaults: githubUser (else gh api user), githubConfigDir (for a service account whose GitHub auth lives under a different OS user), githubCliPath (else gh from PATH).

Commits reuse the existing git-commit event type (so they count and de-dupe against local commits); PRs use a new github-pr type. BuildInsight.summarize() now folds PRs into the read, and the PR's head branch name is used as the label (the per-user feed ships a minimal pull_request with no title, but the branch name is present and just as descriptive — no extra API call per PR).

Files

• Conduit/adapters/github.ts — new adapter
• Conduit/config.ts — github source + githubUser / githubConfigDir / githubCliPath (all optional, coerced/validated)
• Conduit/types.ts — github-pr event type
• Conduit/conduit.ts — register the source in the capture loop
• Conduit/sources.ts — source descriptor for the /conduit "Sources & cadence" panel
• Conduit/BuildInsight.ts — count PRs and include branch labels in the read
• Observability/src/app/conduit/page.tsx — GitHub icon for the new source

Verified (headless Linux)

Enabled the source and ran a capture over the day's activity:

• 28 PR events captured with branch labels (#1650 opened → fix/conduit-linux-cron-scheduling, …) — activity that was completely invisible before.
• BuildInsight then read 32 events and produced a real narrative: "You reviewed 28 pull requests across backend infrastructure, features, and documentation… " — vs. the empty read beforehand.
• With sources.github unset, capture behaves exactly as before (adapter is a no-op).