fix: agent_run param mismatch (send agent_name) + add GitHub push-update (3 inputs: repo name, token, username; --force-with-lease)

Fixes agent_run + adds GitHub push-update:

FIX: handle_agent_run param mismatch
- Backend declared 8 params (prompt, target_language, target_framework,
history_json, skills_json, search_enabled, image_url, agent_name)
but frontend POST body only sent 7 — Gradio raised
'needed: 8, got: 7'. Frontend now sends state.activeAgent as the
8th value, restoring agent_run for ALL prompts (the bug broke agent
mode entirely after the Custom Agents feature shipped).

FEAT: Push Update to GitHub (3 inputs only)
- New backend: code/tools/github.py::push_to_github(repo_name,
github_token, username, branch?, commit_message?, timeout?)
- Workflow: snapshot workspace → fresh git repo in temp dir →
git add -A + git commit → git push --force-with-lease
https://<user>:<token>@github.com/<owner>/<repo>.git <branch>.
- Falls back to plain push if --force-with-lease fails on a brand-new
empty repo (no refs to lease against).
- Token is scrubbed from error messages before being returned.
- New API: push_github(repo_name, github_token, username, ...)
- New UI: 'Push Update to GitHub' section in the Deploy tab with 3
required inputs (repo name, GitHub token, username) + an Advanced
<details> for branch/commit_message.
- Updated README.md and CLAUDE.md with new feature docs.

README.md

@@ -8,11 +8,13 @@ sdk_version: 6.14.0
 python_version: '3.11'
 app_file: app.py
 pinned: false
-hf_oauth: true
-hf_oauth_scopes:
-  - read-repos
-  - write-repos
-  - manage-repos
+# NOTE: `hf_oauth` is intentionally NOT set here. When `hf_oauth: true` is
+# set, HF auto-injects OAUTH_CLIENT_ID / OAUTH_CLIENT_SECRET / OAUTH_SCOPES
+# / OPENID_PROVIDER_URL as env vars, which collides with the same-named
+# Secrets we set on the Space (for using a user-provided OAuth app).
+# Instead, all 4 OAuth env vars are provided as Secrets directly:
+#   OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_SCOPES, OPENID_PROVIDER_URL
+# Gradio's `gradio.oauth` module reads them via os.environ.get() at startup.
 ---
 
 ## SoniCoder