fix: implement actionable review feedback from pending PRs

[Copilot]

Description

Consolidates unresolved review feedback from PRs #4, #13, #25, and #26 into a single PR. Fixes runtime bugs, type safety issues, workflow permission failures, and missing documentation.

Motivation

19 open PRs had accumulated actionable review comments that were never addressed. This PR implements the concrete suggestions to unblock merging.

Changes

TypeScript runtime fixes (PR #26 feedback):

• src/services/xapi.ts: Use URLSearchParams instead of string concatenation, add since_id pagination, add Array.isArray() guard in fetchThread, use unknown over any in parseThread, avoid mutating sort with spread
• src/index.ts: Add console.log → stderr redirect for MCP StdioServerTransport, use unknown[] not any[]
• src/services/agent.ts: Add bounded processedMentions pruning (10k cap) with safe { value, done } iterator, process mentions oldest-first for correct chronological eviction

// Before: type assertion, no bounds, wrong eviction order
this.processedMentions.delete(iter.next().value as string);

// After: safe iteration, bounded, chronological
const { value, done } = iter.next();
if (done) break;
this.processedMentions.delete(value);

Workflow fixes (PR #13 feedback):

• Add explicit permissions blocks to all three workflows (pull-requests: write, issues: write)
• auto-label.yml: Switch to pull_request_target for fork PR support
• issue-triage.yml: Check labels exist before adding to avoid 422 errors

Documentation (PR #25 feedback):

• Add CONTRIBUTING.md, .github/PR_TITLE_GUIDE.md, .github/pull_request_template.md
• Add Contributing section to README.md with absolute paths per review suggestion

CODEOWNERS (PR #4 feedback):

• Replace invalid placeholder names (@codex, @Vercel, @Claude, @Copilot) with @groupthinking

Related Issues

Addresses review feedback from PRs #4, #6, #13, #25, #26

Testing

• Builds successfully (npm run build)
• Tested in simulation mode
• Tested with real API calls (if applicable)

Checklist

• PR title follows conventional commits format (e.g., feat:, fix:, docs:)
• PR description is clear and complete
• Code follows project style guidelines
• Changes are focused and reasonably sized
• Documentation updated (if needed)
• No sensitive information (API keys, tokens) committed

Screenshots / Logs (if applicable)

CodeQL scan: 0 alerts across actions, Python, and JavaScript.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[groupthinking]

Closing stale draft — superseded by cleanup/ready-to-use merge to main