resources-graph: tracer bullet — single issues, PRs and repos served from memory

[antejavor]

Part of PRD: resources-graph. Vocabulary: context-graph/resources-graph/CONTEXT.md. Prototype reference (throwaway): branch prototype/github-resource-graph-model.

What to build

Tracer bullet: an agent reads a public GitHub issue, PR or repository; a later read is served from memory.

• New workspace member resources-graph (pyproject, known-first-party, CI test job), wired into agent-context-graph as the resources-graph connector (runner + doctor).
• Address parser (pure, GitHub adapter) for single items and repos: URLs, owner/repo#n, gh issue|pr view, gh repo view, gh api repos/..., curl to api.github.com, prompt text.
• Connector: tool-start events → FETCHED Touches (with tool_use_id), user prompt messages → PROMPTED Touches. No network.
• Resource store: pending Touches; Repository / Issue / PullRequest upserts keyed on node_id with Comments; Cache Read recorded as a Touch (hit / miss); reads scoped to the asking user, fail closed.
• GitHub source: GraphQL with the optional config-file token; items via issueOrPullRequest(number); public-only; not_found / not_public as Unresolved reasons.
• Sweep CLI (resources-graph sweep) for item and repo Touches.
• resource(address) Tool + session hint, registered on the agent_context_graph.tools entry point.

Acceptance criteria

• Touching memgraph/memgraph#N then running the Sweep stores the item with all comments; resource returns it with fetched_at and updated_at, and records a hit Touch.
• /issues/N that is a PR is stored as PullRequest (review comments with path, changed-file paths, no diff).
• A second user's resource call hits the same Resource; neither user can see the other's Touches.
• Nonexistent / non-public addresses end as Unresolved Touches with the right reason; no placeholder Resources.
• Unit tests for the parser; e2e tests on real Memgraph via dev-memgraph.sh; Sweep tested from recorded GraphQL responses plus one live test behind a skip marker.