[WIP] do not review — feat(minimald): GitHub-integrated sessions (spec 10) - #1130

Domain types, an on-disk grant store (0600, atomic writes), the OAuth
device-flow client, a REST client (authenticated user, App installation,
pull requests), leak-proof `gitops` (env-only credential injection plus an
option-injection guard), and the token-refresh state machine (single-flight,
write-ahead rotation). `test-support` ships an in-process mock GitHub and
the `github-mock` binary so the daemon's auth and git paths can be
exercised without touching real GitHub.

Each consumer's manifest declares the dependency here rather than in its
own commit, so `Cargo.lock` is coherent with every manifest from this
commit on and the series stays bisectable.

Default features are I/O-free — no reqwest — so `mfile` and `minimal` can
depend on the crate without pulling an HTTP stack.

The App client id is baked in at build time: `build.rs` registers
`MINIMAL_GITHUB_CLIENT_ID` as a rebuild trigger so a rotated id is never
served from a stale build cache, and `config.rs` reads it via
`option_env!`. Runtime `MINIMALD_GITHUB_CLIENT_ID` still takes precedence,
for GHES, the mock server, and self-hosted Apps. An installed user has no
other channel: there is no daemon config file, `minimald` is autospawned
rather than run from a service unit, and on macOS it runs as the microVM's
init with an empty environment.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

`GithubBeginLogin`, `GithubPollLogin`, `GithubStatus`, `GithubListAuths`,
and `GithubLogout`.

Also fixes `Errorable`, which hid every daemon-side error. It is
`#[serde(untagged)]`, so serde tries variants in declaration order, and the
response types default all their fields — so with `Ok` first a daemon
`{"error": ".."}` payload decoded as `Ok(Default::default())` and the client
reported a blank success for a refused RPC. `min github login` against an
unconfigured daemon printed an empty verification URI instead of naming the
unset variable. `Err` is now declared first; no response type carries an
`error` field, so this is unambiguous. The bug also affected
`ConfigureLoadout` and `FinalizeSession`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Per-repo specs and scope overrides for repo pre-priming, validated at load
time so a malformed scope is a config error rather than a runtime auth
failure.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… facade

Builds one `GithubService` at daemon startup and shares it across every
session, dispatches the five auth RPCs through the `serve!` macro, and adds
the `authorize()` choke point over session attrs.

The `git%` facade isolates the token-bearing git leg from everything the
sandbox controls: daemon-side git runs only in a daemon-authored bare
mirror, with global and system config denied, and object transfer happens
via `objects/info/alternates` plus plain-file ref writes rather than a git
remote the sandbox could redirect.

`APP_SLUG` names the org's registered App and builds the installation URL
`min github status` prints; a mismatch there is invisible from inside the
daemon, since only that URL breaks.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Drives the device flow through the daemon over SSH RPC, polling with a
terminal spinner until the login resolves.

Attach now runs ssh as a waited-on child rather than `exec()`ing into it, so
control returns to the client once the session shell exits — the seam
post-attach flows such as an exit prompt hook into. Keyboard signals are
ignored while the child runs so Ctrl-C reaches the foreground process
instead of killing the waiting client, and the child's status is propagated
so the observable exit code matches the old `exec()`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Forwards the `MINIMAL_GITHUB_CLIENT_ID` repository variable from a
workflow-level `env` block, so it reaches every build job — including the
`minimald-linux-*` binaries that `build-release-initramfs` repacks as the
guest daemon, which boots with an empty environment and could not be
configured any other way. The reading side is `crates/github`.

A repository variable, not a secret: a GitHub App client id is public,
because the device flow is a public-client flow with no client secret.
Unset resolves to the empty string, which reads as "no App configured", so
a release cut before the variable is set still builds and ships inert.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The workspace is 30 crates now; the map still said 29 and omitted the row.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>