/update: the bot is refused on contributors' forks (worked on the owner's fork), and it doesn't log why #473

Follow-up to #472 (#464).

During its pre-merge test, /update could update a branch in itsskofficial/Sentient, the repo owner's own fork. On the first real use, on #407 from syedmustafan/Sentient with "Allow edits by maintainers" on, PUT /pulls/{n}/update-branch with the workflow token was refused. The fallback worked as designed: the button hint plus the needs update label. A maintainer then ran the same API call with their own credentials and it succeeded.

So the built-in GITHUB_TOKEN probably can't push to forks owned by other people. It only worked on the admin's own fork. The run log (run 39116506769) also doesn't show the status or message GitHub returned, so this can't be confirmed from the log.

To do:

1. Log the update-branch response status and message (no secrets) whenever it fails.
2. Confirm the cause on a contributor fork, and update CONTRIBUTING.md and docs/AGENT_WORKFLOW.md to match. The likely result is that /update merges main on same-repo branches only, and on forks it offers the button and labels the PR for a maintainer. That is fine with our policy, because maintainers handle labelled PRs.
3. Only if the owner wants it: a GitHub App with contents:write could update fork branches. That needs a setup decision, so don't add new secrets without asking.