Infer least-privilege setup in add-wizard

[mnkiefer]

Make gh aw add-wizard infer setup requirements from resolved workflows instead of requiring duplicate declarations in aw.yml.

The wizard should detect required variables, secrets, authentication, GitHub App permissions, and events; reuse existing configuration; open browser approval flows when necessary; and verify setup before finishing. This way, workflows remain authoritative. aw.yml may supply only non-inferable metadata such as prompts, defaults, optionality, and owner constraints.

Reuse the existing add-wizard setup and browser flows. Do not add another CLI command or setup framework.

Already implemented:

• Resolve and compile package workflows.
• Check named repository variables and secrets.
• Prompt for missing values.
• Create or reuse a GitHub App.
• Handle App creation and installation in the browser.
• Store App credentials.
• Skip existing configuration.

Gaps:

• Infer requirements from all package workflows.
• Merge minimum App permissions and events.
• Verify App identity, installation, and permissions.
• Distinguish secret presence from valid configuration where possible.
• Prevent success while required setup remains incomplete.
• Summarize reused, created, and pending requirements.

Security considerations:

• Prefer GITHUB_TOKEN, then GitHub Apps, then fine-grained PATs.
• Request only inferred minimum permissions.
• Never recommend classic PATs.
• Never expose secret values or bypass GitHub approval.
• Show permission changes before requesting approval.

Acceptance criteria

• Packages work without duplicated setup declarations.
• Multiple workflows produce one least-privilege setup.
• Existing configuration is reused and verified.
  Browser flows open only when required.
  Re-running the wizard is idempotent.