Agents comment, humans commit. What genuinely works in repository automation, the permission model that keeps it safe, and why auto-fixing…