feat: GitHub provider lifecycle and onboarding hardening (#351)

* feat: improve GitHub provider onboarding and lifecycle

* fix: address copilot review in provider manager

* fix: address follow-up copilot review comments

* test: resolve rebase conflict in provider profiles suite

* fix: clear stale github hydrated marker

* fix: harden github onboarding auth precedence

* fix: remove merge markers from provider tests

* fix: resolve latest copilot onboarding comments

---------

Co-authored-by: KRATOS <84986124+gnanam1990@users.noreply.github.com>

src/utils/githubModelsCredentials.hydrate.test.ts

@@ -10,6 +10,8 @@ describe('hydrateGithubModelsTokenFromSecureStorage', () => {
     CLAUDE_CODE_USE_GITHUB: process.env.CLAUDE_CODE_USE_GITHUB,
     GITHUB_TOKEN: process.env.GITHUB_TOKEN,
     GH_TOKEN: process.env.GH_TOKEN,
+    CLAUDE_CODE_GITHUB_TOKEN_HYDRATED:
+      process.env.CLAUDE_CODE_GITHUB_TOKEN_HYDRATED,
     CLAUDE_CODE_SIMPLE: process.env.CLAUDE_CODE_SIMPLE,
   }
 
@@ -43,11 +45,13 @@ describe('hydrateGithubModelsTokenFromSecureStorage', () => {
     )
     hydrateGithubModelsTokenFromSecureStorage()
     expect(process.env.GITHUB_TOKEN).toBe('stored-secret')
+    expect(process.env.CLAUDE_CODE_GITHUB_TOKEN_HYDRATED).toBe('1')
   })
 
   test('does not override existing GITHUB_TOKEN', async () => {
     process.env.CLAUDE_CODE_USE_GITHUB = '1'
     process.env.GITHUB_TOKEN = 'already'
+    delete process.env.CLAUDE_CODE_GITHUB_TOKEN_HYDRATED
 
     mock.module('./secureStorage/index.js', () => ({
       getSecureStorage: () => ({
@@ -62,5 +66,6 @@ describe('hydrateGithubModelsTokenFromSecureStorage', () => {
     )
     hydrateGithubModelsTokenFromSecureStorage()
     expect(process.env.GITHUB_TOKEN).toBe('already')
+    expect(process.env.CLAUDE_CODE_GITHUB_TOKEN_HYDRATED).toBeUndefined()
   })
 })