feat(bootstrap): GH_TOKEN-based clone of Scrum4Me + scrum4me-mcp

Fixes the 'no GitHub credentials' deadlock observed in the first
NAS-Docker batch run (2 May 2026): scrum4me-mcp's `wait_for_job`
expects a local clone at `~/Projects/<repo-name>` (convention-fallback
in resolveRepoRoot) but the container had no credentials and no clone.
Agent asked the user how to proceed; turn closed without claim.

Changes:
- `.env.example`: GH_TOKEN (fine-grained PAT, repo+PR scope) and
  GH_PRECLONE_REPOS (comma-separated owner/name list, default covers
  Scrum4Me + scrum4me-mcp).
- `bin/repo-bootstrap.sh` (new): runs as agent-user; configures git
  credential-helper with HTTPS oauth2 token, then clones-or-fetches
  each entry in GH_PRECLONE_REPOS into ~/Projects/<name>. Idempotent.
- `bin/entrypoint.sh`: hooks repo-bootstrap before run-agent.sh.
- `Dockerfile`:
  - installs `gh` CLI (used for auto_pr `gh pr create`; reads GH_TOKEN
    from env directly).
  - pre-creates `~agent/Projects` and `~agent/.scrum4me-agent-worktrees`
    so directory-ownership is right from the first boot.
- `README.md`: 'Repo bootstrap (clone-on-start)' section + GH_TOKEN
  step in the deploy checklist; corrects the obsolete 'no push
  credentials' note (agent now pushes feature-branches, gh creates PRs).

Same token covers clone, push and PR-creation — one secret to rotate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -22,6 +22,28 @@ CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-vervang-mij
 # Als deze ge-revoked wordt: rebuild + redeploy (zie README).
 SCRUM4ME_TOKEN=vervang-mij
 
+# ----- GitHub credentials -----------------------------------
+# Personal Access Token (fine-grained) met:
+#   - Repository access op madhura68/Scrum4Me + madhura68/scrum4me-mcp
+#   - Permissions: Contents (read/write), Pull requests (read/write),
+#                  Metadata (read)
+#
+# Gebruikt voor:
+#   1. Pre-clone van de repos in /home/agent/Projects/<name>/ bij
+#      container-start (entrypoint.sh)
+#   2. `git push` van agent feature-branches via HTTPS
+#   3. `gh pr create` (auto_pr=true) — gh CLI leest GH_TOKEN uit env
+#
+# Genereer op github.com → Settings → Developer settings →
+# Personal access tokens → Fine-grained tokens.
+GH_TOKEN=ghp_vervang-mij
+
+# Lijst (komma-gescheiden) van repos om vooraf te clonen naar
+# ~agent/Projects/<name>. resolveRepoRoot in scrum4me-mcp valt
+# automatisch terug op die conventie. Voeg meer toe als je nieuwe
+# producten/repos toevoegt aan Scrum4Me.
+GH_PRECLONE_REPOS=madhura68/Scrum4Me,madhura68/scrum4me-mcp
+
 # ----- Scrum4Me database ------------------------------------
 # Beide URLs uit het Neon-dashboard. DATABASE_URL is pooled,
 # DIRECT_URL is unpooled — scrum4me-mcp gebruikt DATABASE_URL