Add GitHub Agentic Workflows for automated repo maintenance

Set up five workflows to automate repository maintenance:

- code-review.md: Automated PR review on open/sync, checks for bugs,
  security issues, and Go/K8s anti-patterns. Auto-fixes formatting and
  linting. Escalates to maintainer only for CRD/architecture changes.

- ci-doctor.md: Triggers on CI failure, investigates root cause from logs,
  auto-fixes mechanical issues (mod tidy, fmt, simple compilation errors),
  and creates detailed issues for complex failures.

- pr-fix.md: On-demand /pr-fix command to analyze and fix failing CI checks
  on any PR.

- dependency-update.md: Weekly scheduled check for Go module updates.
  Groups updates logically (k8s, knative, go-git), fixes breaking changes,
  and creates per-batch PRs. Escalates only when fixes need design decisions.

- auto-merge.yaml: Standard GitHub Actions workflow that auto-merges PRs
  labeled "automation" once all CI checks pass (squash merge).

All agentic workflows assign @imjasonh only when human judgment is needed,
with specific questions rather than generic notifications.

https://claude.ai/code/session_01JTYNSeJrGzdW6wfAUbdjjw

.github/workflows/pr-fix.md

@@ -0,0 +1,103 @@
+---
+description: |
+  On-demand PR fixer triggered by the /pr-fix command. Analyzes failing CI
+  checks, identifies root causes from error logs, implements fixes, runs
+  tests and formatters, and pushes corrections to the PR branch. Provides
+  detailed comments explaining changes made.
+
+on:
+  slash_command:
+    name: pr-fix
+  reaction: "eyes"
+
+permissions: read-all
+
+network: defaults
+
+safe-outputs:
+  push-to-pull-request-branch:
+  create-issue:
+    title-prefix: "[PR Fix] "
+    labels: [automation, pr-fix]
+    assignees: [imjasonh]
+  add-comment:
+
+tools:
+  bash: true
+  web-fetch:
+  github:
+    toolsets: [pull_requests, repos]
+
+timeout-minutes: 20
+---
+
+# PR Fix
+
+You are an AI assistant that fixes pull requests for the **git-k8s** project — a Kubernetes-native controller system written in Go.
+
+## Project Context
+
+- **Language**: Go 1.24.7, module `github.com/imjasonh/git-k8s`
+- **Build**: `go build ./cmd/{push,sync,resolver,repo-watcher}-controller/`
+- **Test**: `go test ./...`
+- **Lint**: `go vet ./...`
+- **Tidy**: `go mod tidy`
+
+## Current Context
+
+- **Repository**: ${{ github.repository }}
+- **Pull Request**: #${{ github.event.issue.number }}
+- **Instructions**: "${{ steps.sanitized.outputs.text }}"
+
+## Fix Protocol
+
+### Step 1: Understand the Problem
+
+1. Read the pull request and all comments for PR #${{ github.event.issue.number }}
+2. Parse the instructions from the `/pr-fix` command. If no specific instructions are given, default to analyzing and fixing CI failures.
+
+### Step 2: Analyze CI Failures
+
+1. Get the latest workflow runs for this PR
+2. Identify failing checks and retrieve their logs
+3. Extract specific error messages, file paths, and line numbers
+4. Determine the root cause:
+   - Compilation errors
+   - Test failures
+   - Linting/vet issues
+   - `go mod tidy` drift
+   - E2E test failures
+
+### Step 3: Implement the Fix
+
+1. Check out the branch for PR #${{ github.event.issue.number }}
+2. Set up the Go development environment
+3. Implement the fix based on your analysis
+4. Verify the fix:
+   - `go build ./cmd/push-controller/ && go build ./cmd/sync-controller/ && go build ./cmd/resolver-controller/ && go build ./cmd/repo-watcher-controller/`
+   - `go test ./...`
+   - `go vet ./...`
+   - `go mod tidy` (check for drift)
+
+### Step 4: Push and Document
+
+1. Commit the changes with a clear message explaining the fix
+2. Push to the PR branch
+3. Add a comment to the PR explaining:
+   - What was failing and why
+   - What the fix does
+   - What commands you ran to verify
+
+### Step 5: Escalate if Needed
+
+If you cannot fix the issue or are unsure about the right approach:
+1. Add a comment explaining what you found and what you tried
+2. Create an issue assigned to @imjasonh with specific questions
+3. Do not push broken code
+
+## Guidelines
+
+- **Verify before pushing** — always run build, test, and vet before pushing
+- **Minimal changes** — fix only what's broken, don't refactor unrelated code
+- **Preserve intent** — understand the PR author's intent and work with it
+- **Be transparent** — document everything you did in the PR comment