wip(#1970): github-token injection path (priv wire + hive-priv handler + priv_client + hivectl github set-token)

hive-c0re/src/priv_client.rs

@@ -281,6 +281,19 @@ pub async fn write_agent_matrix_token(
     .await?)
 }
 
+/// Write a GitHub personal access token (PAT) for `agent_name` via hive-priv
+/// (running as root). Writes `<state>/github-token` 0600, chowned to the agent
+/// user so the `gh` wrapper / git credential helper can read it from inside the
+/// container. Single account per agent — no account suffix. The token value is
+/// operator-supplied (for the agent's `hyperhive.githubAccount`).
+pub async fn write_agent_github_token(agent_name: &str, token: &str) -> Result<()> {
+    ok(call(&PrivRequest::WriteAgentGithubToken {
+        agent_name: agent_name.to_owned(),
+        token: token.to_owned(),
+    })
+    .await?)
+}
+
 /// Restart `hive-matrix-daemon.service` inside an agent container via
 /// `systemctl --machine=h-<agent_name> restart hive-matrix-daemon.service`.
 /// Non-fatal: callers should handle errors gracefully — if the container is