Closes #57. G3 of TechDevGroup/devagentic#203.

Summary

• New plugin plugins/hermes-github/ with the same shape as the other devagentic-adjacent plugins (canvas / docs / mutations / vertical-preamble).
• Single MCP tool file_issue(repo, title, body, labels?) registered via mcp_serve.py::_register_github_tools.
• Restricted by design to TechDevGroup/devagentic + TechDevGroup/hermes-agent — anything else returns {"error": ...}.

Why

Under devagentic#203 §3.2 a worker session that discovers a stack gap (missing capability, broken behavior, bug) MUST surface it as a GitHub issue — never edit stack source. Until this tool existed there was no hermes-native path to do so, forcing workers to either (a) shell out to gh (violates NousResearch#203 §1.2 invariant) or (b) silently work around the gap. This tool is the path.

Auth model (worker never sees credentials)

The plugin holds NO credentials. Token resolution happens on the hermes host in priority order:

1. HERMES_GH_TOKEN (dedicated)
2. GITHUB_TOKEN / GH_TOKEN (standard PAT env)
3. gh auth token subprocess (when gh CLI is on PATH)

The resolved token is sent only on the outbound api.github.com request — never logged, never returned to the worker conversation. Required scope: repo (private repos like TechDevGroup/devagentic + TechDevGroup/hermes-agent) or public_repo.

If no token is available, file_issue returns {"error": "no GitHub token available — set HERMES_GH_TOKEN / GITHUB_TOKEN / GH_TOKEN, or run \gh auth login` on the hermes host"}` so the worker gets actionable diagnostics.

Test plan

• 16 client unit tests pass (tests/plugins/hermes-github/test_client.py): allowed-repo restriction (3), arg validation (3), token resolution priority (4 — env priority, env-fallback, gh-CLI fallback, no-token), HTTP behavior (5 — happy path, label handling, HTTP-error surface, network-error surface, invalid-JSON / missing-number guards), schema (1).
• create_mcp_server() smoke-import succeeds; file_issue registered alongside existing 28 tools (29 total now).
• Plugin is additive — no changes to existing modules — so no regression risk.

Notes

• Single tool this PR (not multiple). G3 is intrinsically one capability.
• Allowed-repos set is small + reviewable via _ALLOWED_REPOS in client.py. Operators wanting to widen the scope file a follow-up issue + extend explicitly.
• Workers MUST reference devagentic#203 in any issue they file so stack maintainers understand the gap context (covered in plugin README).