feat: PR security gate, @neurosploit bot, richer NL REPL (#39)

GitHub automation
- integrations: github_set_status (commit status), github_pr_review
  (REQUEST_CHANGES/APPROVE), github_pr_head_sha, and a shared severity
  gate (severity_rank / worst_confirmed_rank / gate_trips — confirmed
  findings only).
- `neurosploit pr --fail-on <critical|high|medium|low>`: on a confirmed
  finding at/above the threshold, sets a failing `neurosploit/security`
  commit status, posts a REQUEST_CHANGES review, and exits 2 so a CI
  check fails — branch protection then blocks the merge.
- Two ready GitHub Actions: neurosploit-pr-gate.yml (review + block every
  PR) and neurosploit-mention.yml (writers comment @neurosploit <text> to
  trigger a scan; any language; URL → black-box, else PR review).

Natural-language REPL
- Intent now also parses spoken toggles/knobs across PT/EN/ES: Burp/proxy,
  browser/MCP, subscription, "N votos/votes", recon depth (number or
  quick/deep/exhaustive), plus stop verbs. handle_nl returns the follow-up
  command (/run or /stop).

Docs: README trimmed to features (version changelog stays in RELEASE.md),
new automations documented in README + TUTORIAL-INTEGRATION.

Tests: gate (3), NL toggles/stop (added). All green.


Claude-Session: https://claude.ai/code/session_018BGLy4j5qsqqid6CoovowC

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

examples/github-actions/README.md

@@ -0,0 +1,22 @@
+# NeuroSploit — GitHub Actions templates
+
+Copy either file into your repository's `.github/workflows/` directory to enable
+the automation. Add an `ANTHROPIC_API_KEY` secret (Settings → Secrets and
+variables → Actions), or swap the `MODEL`/key for a provider you use. The built-in
+`GITHUB_TOKEN` already covers commit statuses, PR reviews and comments.
+
+| Template | What it does |
+|----------|--------------|
+| `neurosploit-pr-gate.yml` | Reviews every pull request and **blocks the merge** on a confirmed critical (fails the check + sets a `neurosploit/security` commit status + posts a REQUEST_CHANGES review). |
+| `neurosploit-mention.yml` | Comment **`@neurosploit`** on a PR/issue (writers only) to trigger a scan. Text after the mention steers it, in any language; a URL runs a black-box test, otherwise it reviews the PR. |
+
+## Enforce the PR gate as a merge block
+
+1. Add `neurosploit-pr-gate.yml` to `.github/workflows/` and let it run once on a PR.
+2. Repo **Settings → Branches → Branch protection rule** on your default branch.
+3. Enable **Require status checks to pass** and select **`neurosploit-pr-gate`**.
+4. (Optional) Enable **Require a pull request review** so the REQUEST_CHANGES
+   review it posts must be resolved/overridden before merge.
+
+These live here (not in `.github/workflows/`) so this repo doesn't run them on
+itself — they're templates for **your** repo.