feat(synconcall): sync oncall rotation to a GitHub team

[d-bytebase]

What

Adds a GitHub org team as a third sync target for synconcall, alongside the existing Google Group and Slack user group. On every rotation, the current primary + secondary are reconciled into the bytebase-oncall team — same semantics as the other two targets.

Why

We want an addressable GitHub team (like bytebase-dev) that always points at whoever is on call, for mentions / reviews / notifications, kept in sync automatically.

How

synconcall's GroupsClient interface is generic, so GitHub drops in with no change to the Sync() reconciliation logic.

• synconcall/github.go — GitHubTeamClient implementing ListMembers/AddMember/RemoveMember against /orgs/{org}/teams/{slug}/memberships/… (plain net/http, no new deps), plus a CSV mapping loader. The rotation stays email-based; the client translates email↔username internally (like the Slack client does for Slack IDs).
• github-users.csv — email → GitHub username mapping (GitHub teams are username-keyed; the schedule is email-keyed).
• synconcall/main.go — --github-org, --github-team, --github-users, --github-token flags + a GitHub sync block. Token also read from GH_TOKEN / GITHUB_TOKEN.
• .github/workflows/sync-oncall.yml — runs the sync for org bytebase, team bytebase-oncall, using secrets.GHA_DISPATCH_TOKEN.

Note: the team is fully reconciled to the current on-call pair, so manually-added members are removed on the next run — matching the existing Google/Slack behavior.

Before this works

1. Create the team: gh api -X POST orgs/bytebase/teams -f name='bytebase-oncall' -f description='Current on-call primary + secondary (auto-synced)' -f privacy='closed' (needs admin:org).
2. Ensure secrets.GHA_DISPATCH_TOKEN has org Members: write.

Testing

• go build, go vet, and go test ./... pass.
• Added synconcall/github_test.go covering the mapping loader (valid + malformed) and the email↔username reverse map.

🤖 Generated with Claude Code