v2.9.0: review inbox without going to GitHub

[Param-Harrison]

Summary

• Dashboard-native PR review: diff, gate evidence, verify verdict, CI status and per-stage cost, no trip to GitHub required
• Multi-repo inbox aggregation via discoverRepos, with a repo filter in the dashboard
• Operator "Approve and merge" button, sharing the same attemptMerge primitive as the automated merge.policy, with its own audit-comment wording
• changesRequestedStale: a CHANGES_REQUESTED review against a commit the head has since moved past no longer blocks the item

See CHANGELOG.md (v2.9.0) for the full breakdown and the "Not in v2.9.0" list.

Verification

• make check: typecheck + full test suite (791 pass) + skills-ref validation, all green
• New structural tests: tests/merge-policy-operator.test.ts (one merge function serves both the operator button and the automated policy; the audit comment is distinct and always carries the head-sha marker)
• Existing structural test (tests/inbox.test.ts) confirms every inbox label still maps to exactly one kind with an action, unaffected by the new kinds
• Live check against a real in-review PR (learnwithparam/splitbill-demo issue v2.6.2: any repo, safely #10 / PR #16): the new review route returned the actual diff, CI status, gate evidence and verify verdict from GitHub
• Manual browser walkthrough (Playwright) at 1440/768/375px in light and dark themes: inbox list, review panel (diff/CI/gate/cost table), repo filter, and the approve-and-merge call, all render correctly with zero console/page errors

Test plan

• gh pr merge this PR (command below)
• After merge, tag v2.9.0 on the merge commit and confirm CI on main is green

🤖 Generated with Claude Code