docs: fine-grained GitHub PAT permissions + manual webhook setup

[jkwiecien-solvd]

What

Documents the exact GitHub token permissions Cascade needs, and a manual webhook-creation fallback.

The getting-started guide previously said only to create tokens "with `repo` scope". That's misleading for fine-grained PATs, which ignore the `repo` scope and the repository admin role — they require explicit per-permission grants. In practice this means:

• Webhook creation fails with `403 Resource not accessible by personal access token` when the Webhooks permission is missing (even on a repo where the token's account is admin).
• Agent actions break at runtime without Contents / Pull requests / Issues / Actions.

Changes (docs/getting-started.md)

• Step 6 (GitHub bot tokens): replaced the one-liner with a per-token, per-permission table (implementer vs reviewer) covering both classic and fine-grained tokens. Derived from the actual API surface in src/github/client.ts:
  • Reviews are submitted under Pull requests (there is no separate Reviews permission).
  • PR comments go through the Issues API (issues.createComment/updateComment/deleteComment).
  • CI status is read via the Actions API, not Checks.
  • Added an explicit "leave unset" list (Commit statuses, Checks, Deployments, etc.).
• Step 9 (Set Up Webhooks): added a manual curl webhook-creation block for local/ngrok setups, noting the callback URL must target the router (:3000), not the dashboard (:3001), and that a 403 means the Webhooks permission is missing.

Why

Docs-only. Closes a real setup papercut: the prior guidance led to repeated 403s when registering the GitHub webhook with a fine-grained token.

🤖 Generated with Claude Code

[zbigniewsobiecki]

Really useful table — and the claims hold up against the actual client surface (issues.createComment for PR comments, reviews under pulls.createReview, CI via the Actions API). Two small factual fixes before merge:

1. The Webhooks row says "One-time webhook creation (step 7)" — webhook setup is step 9 (your classic-token paragraph already references step 9 correctly).
2. The manual curl example includes "push" in the events array, but the programmatic path registers exactly GITHUB_WEBHOOK_EVENTS (src/api/routers/webhooks/github.ts:6): pull_request, pull_request_review, pull_request_review_comment, check_suite, issue_comment — no push. Could you drop it so the manual fallback matches what CASCADE actually subscribes to?

With those two, happy to merge.