Feature proposal: reply in the thread when the folder's forge account is @mentioned #1107

Auto-processing turns new issues and PRs into tasks, but once a task exists there is no way to talk to it from the forge. Teams that give codeg its own forge account would like to @mention that account in an issue / PR / MR comment ("can you check why this test fails?") and get an answer in the same thread.

Proposal

• The existing /api/forge_webhook additionally accepts comment events: GitHub issue_comment / pull_request_review_comment, GitLab Note Hook, Gitea/Forgejo issue_comment.
• The payload is only a pointer. The comment and the item are re-read from the forge API with the folder's own credentials, the same way a scan reads items today.
• A comment that mentions the folder's account (the login resolve_forge_auth already resolves) and comes from an author on a per-folder allowlist mints a reply task: report deliverable, no commits. The task gets the thread as fenced untrusted data.
• When the user completes the task, codeg posts the agent's reply into the same thread (inline review threads and GitLab discussions included).

Safety

• Opt-in per folder, webhook required. An empty allowlist means nobody can trigger it.
• The account's own comments never trigger it (no loops). Mentions inside code, quotes, e-mail addresses and longer handles are ignored. Edits don't trigger it.
• Each comment is handled at most once (unique claim per comment), across redeliveries and folders sharing a repository.

Two deliberate departures from current rules — feedback welcome

1. Agent-written text reaches a forge thread. writeback_comment_body stays as it is; the reply goes through a separate path, and only after the user completes the task.
2. Later, as a separate PR and only if you agree: an opt-in "post replies without review" for replies that changed no files.