fix(cli): validate GitHub token responses without leaking credentials - #1004

🎯 What & why

Validate the GitHub-token HTTP boundary and return a safe authentication error when verification fails. A null response previously raised a TypeError; a rejected request preserved its original error, which could contain request credentials.

🛠️ How it works

GhTokenAdapter accepts a 2xx response with a nonblank string login. Rejected requests, malformed bodies, and non-success responses produce AuthenticationError("GitHub API") without retaining the underlying error as a cause.

Adapter tests substitute the HTTP port and use synthetic tokens. They cover success, authorization options, malformed responses, HTTP failure boundaries, and error confidentiality. No GitHub request or host CLI is invoked by these tests.

🧪 How to verify

• cd cli && pnpm exec vitest run --project=unit tests/runtime/auth: 42 tests passed; the adapter has 17 cases, 11 of which failed on the original source.
• cd cli && pnpm test:coverage: 6,960 tests passed, one skipped, all existing thresholds passed on the current next base.
• cd cli && pnpm exec stryker run --mutate src/runtime/auth/gh-token-adapter.ts --concurrency 2: all 39 mutants killed.
• Typecheck, lint, knip, and build passed. Bundle: 750.75 KB within the unchanged 751 KB budget. One existing lint warning remains in the unrelated uninstall use case.

Validation report.

⚠️ Heads-up

Token-verification HTTP and network failures now use the generic authentication message instead of forwarding transport diagnostics. No coverage, mutation, or bundle threshold is changed.

🔗 Linked issue

Closes #467

✅ I certify

• I DO CERTIFY I READ EACH LINE OF THE PULL REQUEST BECAUSE I AM A SOFTWARE ENGINEER, NOT A AI PUPPY.