fix(github): address PR feedback for onboarding flow

- Set competing provider flags to undefined in updateSettingsForSource to ensure clean GitHub boot
- Fix resolveProviderRequest to default to github:copilot when OPENAI_MODEL is unset
- Hydrate secure tokens and managed settings in system-check.ts to prevent false negatives
- Add models:read scope to GitHub device flow

src/services/api/providerConfig.ts

@@ -194,11 +194,12 @@ export function resolveProviderRequest(options?: {
   baseUrl?: string
   fallbackModel?: string
 }): ResolvedProviderRequest {
+  const isGithubMode = isEnvTruthy(process.env.CLAUDE_CODE_USE_GITHUB)
   const requestedModel =
     options?.model?.trim() ||
     process.env.OPENAI_MODEL?.trim() ||
     options?.fallbackModel?.trim() ||
-    'gpt-4o'
+    (isGithubMode ? 'github:copilot' : 'gpt-4o')
   const descriptor = parseModelDescriptor(requestedModel)
   const rawBaseUrl =
     options?.baseUrl ??

src/services/github/deviceFlow.ts

@@ -11,7 +11,7 @@ export const GITHUB_DEVICE_ACCESS_TOKEN_URL =
   'https://github.com/login/oauth/access_token'
 
 /** Match runtime devsper github_oauth DEFAULT_SCOPE */
-export const DEFAULT_GITHUB_DEVICE_SCOPE = 'read:user'
+export const DEFAULT_GITHUB_DEVICE_SCOPE = 'read:user,models:read'
 
 export class GitHubDeviceFlowError extends Error {
   constructor(message: string) {