Classify GitHub secondary and abuse rate limits

[davidahmann]

Problem
The shared GitHub error layer classified invalid tokens and some scope failures, but it left primary, secondary, and abuse-limit responses effectively untyped.

Why now
Rate limits are a routine operational condition for this server. Downstream tooling needs to distinguish quota exhaustion from auth/policy failures without parsing transport-specific text.

What changed

• added shared HTTP error classification for rate_limited, secondary_rate_limited, and abuse_rate_limited
• preserved Retry-After metadata when GitHub provides it
• extended unit coverage for the new classifications and documented the rate-limit codes in docs/error-handling.md

Validation

• go test ./pkg/errors ✅

Refs #2219

[davidahmann]

Operator impact: downstream tooling can now distinguish primary quota exhaustion, secondary rate limits, and abuse limits from auth/scope failures without parsing GitHub-specific error text.

Minimal change: the shared error layer now classifies rate-limit variants centrally, preserves Retry-After metadata when present, and documents/tests the new codes.

Validation:

• go test ./pkg/errors

Risk/blocker: none in the changed path.
Inspired by research context: CAISI publishes independent, reproducible AI agent governance research: https://caisi.dev