feat(runtimes): slice 1 — `github` runtime + declarative git/push/guard flags on code runtimes (#776 slice 1/3)

[rafeekpro]

Part of #776. Highest-leverage slice — landing this makes ~80% of cortex node bodies declarable.

Scope

1. github runtime — new adapter in packages/runtimes/src/dap_runtimes/adapters/

Declarative GitHub ops:

• op: read_issue — templated params (issue number, repo) → issue body into state
• op: comment — post a comment
• op: update_issue_section — replace a marked section in issue body
• op: create_branch, open_pr, merge_pr, read_pr
• Token via DAP env layering (role-separated tokens map to instance/project env vars — see the CORTEX_GH_TOKEN_{READ,ISSUES,CODE,MERGE} pattern already used in DAP)
• Dashboard runtime-config schema in apps/dashboard/src/components/agents/runtime-config-schemas.ts
• TDD: unit tests with mocked httpx/octokit; integration tests hitting a real repo scoped by env var (skip in CI without token)

2. Config flags on existing code runtimes (claude-code, codex, aider)

Either add flags directly OR introduce a small git/workspace runtime that wraps the code runtime call:

• branch — branch to check out before invoking the code CLI
• base — base branch (defaults to main/develop)
• push — push after the CLI commits (bool + optional force_with_lease: false)
• workspace — resolves to a working directory (per-project cortex-style: ~/.cortex/projects/*/repo)

3. Declarative guards — flags on the code/git runtime

Lifted 1:1 from cortex/nodes/execution.py:

• require_nonempty_diff — fail if the CLI produced no diff (silent-zero-output)
• append_only — reflog rewrite guard: reject if CLI rewrote existing commits
• ancestry_guard — reject if CLI force-pushed over commits authored by non-CLI actors

Acceptance criteria

• github adapter implements the BaseAdapter contract; registered in the runtime registry (packages/runtimes/src/dap_runtimes/adapters/__init__.py or equivalent)
• All 7 GitHub ops covered
• Dashboard runtime-config schema renders in the agent editor
• Existing claude-code/codex/aider adapters gain the branch/base/push/workspace + 3 guards config
• TDD: unit + integration tests (real behaviour, not file-existence checks, per .claude/rules/infrastructure-quality.md)
• No clear-text token logging (audit _log_line, adapter debug hooks)
• Docs + a minimal example bundle showing the github runtime driving a "read issue → comment" pipeline
• ruff/mypy/pytest + dashboard typecheck/build green

Non-goals

• Retry loops (Slice 2)
• Tool-loop agent runtime (Slice 3)
• Sandboxed exec (Part C exploration)
• Absorbing cortex's specific prompts (those stay data in the bundle)

References

• packages/runtimes/src/dap_runtimes/adapters/base.py — BaseAdapter contract
• apps/dashboard/src/components/agents/runtime-config-schemas.ts — dashboard schemas
• .claude/rules/infrastructure-quality.md — TDD + real-behaviour test rule
• cortex-project reference: cortex/nodes/coder.py, cortex/nodes/execution.py (guard behaviour)