GitHub connector should support issue creation or surface permission upgrade flow

Codex GitHub integration can read a public repo through the connected GitHub app, but creating an issue required falling back to the gh CLI and a separate browser login.

Expected behavior:
If GitHub is connected in Codex and the user asks to create an issue, Codex should either:

1. create the issue through the GitHub connector when permissions allow it; or
2. clearly explain that the connector is read-only for this repo/account and offer an in-app permission/auth flow.

Actual behavior:
In a Codex Desktop session, the GitHub connector could read openai/codex repository metadata, but issue creation was not available through the exposed connector tools. The connector showed read-only repository permissions:

pull: true
push: false
triage: false
admin: false

The workflow then had to fall back to:

gh auth login --hostname github.com --web --git-protocol https
gh issue create --repo openai/codex ...

This required a second browser-based GitHub authorization even though the user had already connected GitHub to Codex.

Why this matters:
From the user's perspective, "GitHub is connected" implies that common issue workflows should work through Codex. Having to separately authenticate gh is confusing and makes the connector feel incomplete.

Suggested fix:

• Expose issue creation through the GitHub connector when permissions allow it.
• If the installed GitHub app only has read permissions for a repository, show a clear permission state and offer a path to upgrade/re-authorize.
• Avoid silently requiring a CLI fallback for common issue creation workflows.
• If gh fallback is still needed, explain that it is a separate authentication path from the Codex GitHub connector.