Locking GitHub PATs behind Touch ID with 1Password

A minimal-disruption macOS setup that fetches GitHub PATs from 1Password, gated by Touch ID, instead of caching them in the keychain