feat: GitHub App manifest 扩到主机最大权限

仓库权限除 metadata 外全部拉到最高档（contents/pull_requests/
issues/actions/checks/workflows/administration 等全部 write，
members 只读），事件补齐 push/check_run/workflow_run 等；
旧权限 contents/pull_requests write + issues read 不再是上限。
风险明示：administration=write 含删库/转移，secrets=write
含管理 secret，配 All repositories 时影响面为全账号仓库。
注意：改代码只改以后新建 App 的 manifest，线上 App
(id 5476837) 仍需在 GitHub 设置里改权限并接受新权限。

cloud/tests/test_github_app.py

@@ -86,9 +86,16 @@ class ManifestTestCase(unittest.TestCase):
         self.assertEqual(m["redirect_url"], BASE + "/github-app/callback")
         self.assertEqual(m["default_permissions"]["contents"], "write")
         self.assertEqual(m["default_permissions"]["pull_requests"], "write")
-        self.assertEqual(m["default_permissions"]["issues"], "read")
+        self.assertEqual(m["default_permissions"]["issues"], "write")
+        self.assertEqual(m["default_permissions"]["workflows"], "write")
+        self.assertEqual(m["default_permissions"]["administration"], "write")
+        self.assertEqual(m["default_permissions"]["actions"], "write")
+        self.assertEqual(m["default_permissions"]["checks"], "write")
         self.assertIn("issue_comment", m["default_events"])
         self.assertIn("pull_request", m["default_events"])
+        self.assertIn("push", m["default_events"])
+        self.assertIn("check_run", m["default_events"])
+        self.assertIn("workflow_run", m["default_events"])
         self.assertFalse(m["public"])
 
     def test_manifest_requires_base(self):