Add list_user_events for recent GitHub activity

[kaii9]

Summary

Add a read-only list_user_events tool in the users toolset so agents can retrieve a user's recent GitHub activity with pagination.

Why

Fixes #2420. Query GET /users/{username}/events as requested by the issue. GitHub returns public events for other users and may include private events when querying the authenticated user's own activity, subject to the token's permissions.

What changed

• Register concrete Go input and output types with the v2 typed tool path; modern clients receive an output schema and structured results, while legacy clients retain JSON text.
• Advertise and validate integer pagination; use page 1 and 30 events per page by default, with perPage limited to 1–100.
• Return compact event metadata, the API's public visibility flag, and event-specific payloads. Retain unknown event types and exact payload numeric IDs.
• Recursively clean payload strings with the existing sanitizer. Label all-public pages public/untrusted and pages with private or unknown-visibility events private/untrusted when IFC labels are enabled.
• Add handler/protocol tests, input/output schema snapshots, and generated README documentation.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added

list_user_events(username, page?, perPage?) joins the default users toolset. There is no publicOnly option; event visibility follows GitHub's endpoint and the current credentials.

Prompts tested (tool changes only)

Representative workflow: "Summarize kaii9's recent GitHub activity." Validation uses equivalent direct MCP requests rather than an LLM prompt run: activity queries, explicit pagination, missing/invalid arguments, legacy JSON, modern JSON, and modern CSV. Live event metadata is compared with an independent call to the same GitHub Events endpoint.

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

The tool follows the existing repository public-read scope policy; GitHub remains responsible for access checks and fine-grained private Events permissions. Private events are retained when the API returns them, and result confidentiality is derived from returned event visibility. Missing visibility is conservatively private. Payload content remains untrusted. The tool description documents the feed's 300-event, 30-day history limit and possible latency; callers control page size.

Tool renaming

• I am renaming tools as part of this PR
• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint — 0 issues.
• Tested locally with ./script/test (go test -race ./...); the full suite passed after switching to /events and adding visibility handling.

Also built the binary, regenerated docs, ran CI-mode feature/schema checks without test cache, and validated live read-only MCP calls. Private-event retention and mixed-page confidentiality are covered with simulated GitHub responses; the account's current live sample contained public events.

Docs

• Not needed
• Updated (README / docs / examples)

Generated README tool documentation and schema snapshots.