[Feat] Enable GitHub pull request auto-merge from sessions

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

Related issue

Fixes #

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

What changed

Sessions (Fast) can now enable auto-merge on GitHub pull requests through a native enable_pull_request_auto_merge tool on the GitHub MCP endpoint. GitHub's own MCP server has no auto-merge tool, so the endpoint answers this one in-process, mirroring the existing ADO/Gitea native merge handler conventions:

• Explicit human intent: the tool requires a signed-in member's user-scoped auth token, like the other GitHub write tools; coding-task run tokens never see or call it.
• Fresh-head binding: the caller passes expectedHeadSha from a pull request read taken immediately before the call; the handler re-reads the pull request and rejects a closed, already merged, or head-moved pull request instead of acting on stale state.
• GitHub stays the enforcement boundary: the mutation runs under the same installation token scoped to the connected repository, and repository permissions, branch protections, required checks/reviews, and allowed merge methods are left to GitHub. Auto-merge-disabled repositories and unsupported merge methods get clear errors, and provider permission failures propagate with GitHub's own message.
• Post-mutation verification: the pull request is re-read after the GraphQL enablePullRequestAutoMerge mutation and success is only reported when auto-merge is actually enabled (already-enabled pull requests report alreadyEnabled without mutating).
• Authorization is recorded through the same source_control_mcp_auto_merge_authorized audit event shape the ADO/Gitea merge handlers use.

Fast guidance and the GitHub provider docs now name the capability and the fresh-read/head-SHA rule.

How it was tested

Added apps/api/src/handlers/mcp/__tests__/github-auto-merge.test.ts (14 tests) covering tool discovery for members vs run tokens, schema/argument validation, member-only authorization, connected-repository requirement, stale-head race rejection, closed/merged rejection, auto-merge-disabled and unsupported-method errors, provider failure propagation, successful mutation with post-read verification, already-enabled idempotence, unconfirmed-mutation failure, and the audit event. Full apps/api/src/handlers/mcp suite (937 tests), pnpm lint, pnpm check-types, pnpm knip, and the docs Mintlify/broken-link check all pass.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

[roomote-community]

No code issues found. See task

• apps/api/src/handlers/mcp/github-auto-merge.ts:315 atomically binds the auto-merge mutation to expectedHeadSha through GitHub's expectedHeadOid condition.

_{Reviewed 25fe22e}