start the forge and github pollers when their token lands late

Both pollers wait about ten minutes for the agent's token, then exit 0.
Under Restart=on-failure that exit is final, and nothing started them
again, so a token minted or placed after the window left the agent
without notifications until its container restarted.

Add a path unit per poller with PathChanged on the token file(s) the
poller reads, the shape forge-avatar-sync already uses. A path unit
starts its service only when it is not running, so a poller that found
its token is untouched. The github path unit is gated on
github.enable like its service.

Container-side: it ships with the agent's next rebuild, and an agent on
an older rev keeps the old behaviour.

Closes #6179

nix/agent-modules/github.nix

@@ -127,5 +127,18 @@ in
         Group = userName;
       };
     };
+
+    # Starts the poller when the token appears after it gave up waiting for one
+    # (about ten minutes, then exit 0, which `on-failure` does not restart).
+    # The operator places the PAT through the swarm after the agent runs, so
+    # that is the usual order. A path unit starts its service only when it is
+    # not running. `PathChanged=` because the fetch renames the file into place,
+    # and a `PathExists=` that already holds would re-fire on every re-arm.
+    # Gated on the service it triggers.
+    systemd.paths.hive-github-notify = lib.mkIf config.services.hyperhive.agent.github.enable {
+      description = "start hive-github-notify when the GitHub token appears";
+      wantedBy = [ "multi-user.target" ];
+      pathConfig.PathChanged = "/agents/${userName}/state/github-token";
+    };
   };
 }