chore(bot): configure environment variable redaction bypass

This adds a settings.json file to the bot's configuration to explicitly allow GH_TOKEN and GITHUB_TOKEN to bypass the environment variable redaction engine. This is required because the bot runs in GitHub Actions, which enforces strict redaction mode by default. The workflow file was also simplified by removing the wrapper script that was previously used to bypass redaction.

tools/gemini-cli-bot/.gemini/settings.json

@@ -0,0 +1,7 @@
+{
+  "security": {
+    "environmentVariableRedaction": {
+      "allowed": ["GH_TOKEN", "GITHUB_TOKEN"]
+    }
+  }
+}

tools/gemini-cli-bot/.gemini/skills/issue-fixer/SKILL.md

@@ -26,7 +26,7 @@ maintain existing PRs to reduce the repository backlog.
     - If any require attention (CI failure, requested changes), focus your entire run on resolving ONE of them.
     - Do NOT start a new issue fix if an existing PR needs work.
 2.  **Search for Candidates**: If no PRs need attention, search for `effort/small` issues: `gh issue list --label "effort/small" --limit 10 --json number,title,url`.
-    - **CRITICAL**: Do NOT run local discovery commands (e.g., `npm run lint`, `npm run typecheck`) to look for "easy fixes". `gh issue list` is your ONLY source for new tasks.
+    - **CRITICAL**: `gh issue list` is your ONLY source for new tasks. If `gh` fails, you MUST diagnose the environment or abort the discovery phase. You are STRICTLY FORBIDDEN from using `google_web_search` to query GitHub, as it indexes closed issues. Do NOT run local discovery commands (e.g., `npm run lint`, `npm run typecheck`) to look for "easy fixes".
 3.  **Select ONE Issue** and implement a fix on a new branch.
 4.  **Verify** via `npm run preflight`.
 5.  **Use the `prs` Skill** to stage changes and prepare the draft PR (label: `bot-fix`).

tools/gemini-cli-bot/ci-policy.toml

@@ -16,3 +16,9 @@ toolName = "invoke_agent"
 decision = "allow"
 priority = 999
 interactive = false
+
+[[rule]]
+toolName = "google_web_search"
+decision = "deny"
+priority = 999
+interactive = false