GitHub tokens for agent fleets — safe automation without paste-a-PAT

How to give coding agents GitHub access without long-lived PATs in chat: short-lived App tokens, a deterministic credential broker, personal vs bot identity, and fail-closed landing.