Add a deterministic provenance-linked Issue workflow effect

[taras]

Story

As a workflow author, I want Issue to reconcile an approved deferred finding idempotently, so valid out-of-scope work remains visible without silently expanding the active pull request.

Scope

Create or resolve an issue from a deferred finding, link it to the originating workflow run, expansion, review, pull request, and evidence, and record reconciliation state.

The planner proposes a disposition. Taras retains authority over material behavior, architecture, scope, and risk decisions.

Acceptance

• Replay cannot create duplicate issues for the same deferred obligation.
• The issue records origin, evidence, deferral rationale, dependency impact, and intended timing.
• Conflicting existing state is diagnosed rather than silently overwritten.
• Rejected, fix-now, and inserted-repair findings create no deferred issue.
• Uncertain completion is reconciled through Add shared external forge-effect reconciliation #297's shared GitHub contract.
• No issue is created before the user's approval authorizes that exact effect.

Dependencies

• Add a deterministic PullRequest workflow effect #295
• Add shared external forge-effect reconciliation #297
• End goal: Document adversarial implementation workflow WIP #181.