feat(#1957): wire gh-identity plugin into workspace-server

[molecule-ai]

Summary

Cherry-pick f190ff4 from feat/1957-gh-identity-plugin-wireup (PR #1977, closed due to stale base SHA). Rebuilt cleanly from current staging HEAD.

Changes

• Add github.com/Molecule-AI/molecule-ai-plugin-gh-identity dependency to go.mod (v0.0.0-20260424033845)
• Wire gh-identity EnvMutator chain via provisionhook.NewRegistry() in main.go alongside github-app-auth plugin (uses Registry.Mutators() to merge chains)
• Add MOLECULE_AGENT_ROLE injection in both provision paths (provisionWorkspace + provisionWorkspaceCP) for role-aware plugin attribution
• Add Registry.Mutators() method to pkg/provisionhook/mutator.go for cross-plugin registry merging

Motivation

Tracks molecule-core#1957 — gh-identity plugin needs MOLECULE_AGENT_ROLE injected into workspace env vars at provision time so the plugin can perform per-agent attribution via env injection + gh wrapper.

Test plan

• CI passes on staging
• gh-identity plugin receives correct MOLECULE_AGENT_ROLE per workspace
• workspace provision completes without env-mutator errors

🤖 Generated with Claude Code