Extract the GitHub transaction layer of the planning stages into the CLI

[sameera]

Extract the deterministic GitHub transaction layer of /nxs.epic and /nxs.decision-record into the nexus CLI (same distributable as the workspace setup CLI and the portable tools), so the slash commands own judgment only (prose + human gates) and every state transition is one idempotent verb: nexus epic file (epic issue idempotent on link, story sub-issues + blocked_by wiring, labels, entry naming) and nexus record file|approve|revise|status|hash|gate.

record hash is the single canonical hash implementation every stamp (analyze/close/distill) calls — three stages computing their own sha256 in bash will drift on canonicalization. record gate is an exit-code preflight (same pattern as pr_worktree.ts preflight) callable from CI as a required check, making "an open record blocks downstream" enforceable outside a Claude session. Consolidates the nxs-gh-create-epic / nxs-gh-create-story scripts and shares the one github-config resolver.

Meta

• feature: docs/features/multi-repo-workspaces
• estimate: M
• candidate stories: nexus epic file transaction (idempotent, workspace-aware); the nexus record verb set with the canonical hash; record gate as a CI-callable preflight; consolidate the gh-create scripts onto the shared config resolver; re-scope /nxs.epic and /nxs.decision-record to judgment + verb calls
• source: session design discussion (2026-07-21)
• migrated: 2026-08-01, from the per-feature backlog file retired by Backlog Stubs Become GitHub Issues #185

Notes

Extends the deterministic-vs-judgment seam the setup CLI established to the planning stages. Triage must consolidate it with the Nexus Setup CLI (#60) and GitHub Publishing Config (#121) so the gh mechanics and the config resolver live in exactly one place. The record verbs presuppose the sub-issue record (#139); the nexus epic file verb could split out earlier if needed.