github: PATs live in swarm bao; the agent fetches them itself

An operator links an agent's GitHub personal access token in the swarm UI
(LinkGithubAccountForm, "link github account" on /agents). swarm-controller's
PUT /api/hives/{hive}/agents/{agent}/github-account stores it at
swarm/agents/<agent>/github-token (swarm_secret_client::github), a flat leaf
under the agent's prefix that the agent's existing read grant already covers:
no policy change, and no list grant, since there is one token per agent.

In the agent, hive-agent-github-token (oneshot + 2-minute timer, as the agent
user, under its own store certificate, ordered before hive-github-notify)
reads that path and writes <state>/github-token, 0600 and agent-owned, the
file the gh wrapper, git credential helper and hive-github-notify already
read. It replaces the file by rename only when the bytes changed and never
deletes it: a hive-written github-token stays until a token is linked in the
swarm UI. It is installed only with a store address and
services.hyperhive.agent.github.enable.

Removed: the dashboard's CR3D3NTIALS page (credentials.html/js/css, its
build entries and H0M3 tile; GITHUB was its only tab), hive-c0re's
dashboard/matrix_accounts.rs with GET/POST /api/github-account,
priv_client::write_agent_github_token, the host socket's
SetAgentGithubToken and `hivectl github set-token`, and hive-priv's
WriteAgentGithubToken with write_agent_state_file, its only caller gone.

Docs: integrations/github.md and swarm/ui.md describe the swarm path,
swarm/credentials.md gains the store-path row, and the hive UI docs,
hivectl docs and security.md's hive-priv table drop the removed pieces.

Closes #4347

docs/swarm/ui.md

@@ -7,13 +7,13 @@ domain, covers host-level detail for one hive.
 
 ## What it shows
 
-| route                     | what                                                                                        |
-| ------------------------- | ------------------------------------------------------------------------------------------- |
-| `/`                       | the hive directory, each hive with its last reported status                                 |
-| `/agents`                 | every agent: status, config PR, wanted state; create agents, link forge and matrix accounts |
-| `/agents/<name>/terminal` | one agent's live terminal                                                                   |
-| `/jobs`                   | the controller's job graph — where agent creation and credential mints show progress        |
-| `/issues`                 | a cross-repo issue report                                                                   |
+| route                     | what                                                                                                |
+| ------------------------- | --------------------------------------------------------------------------------------------------- |
+| `/`                       | the hive directory, each hive with its last reported status                                         |
+| `/agents`                 | every agent: status, config PR, wanted state; create agents, link forge, matrix and GitHub accounts |
+| `/agents/<name>/terminal` | one agent's live terminal                                                                           |
+| `/jobs`                   | the controller's job graph — where agent creation and credential mints show progress                |
+| `/issues`                 | a cross-repo issue report                                                                           |
 
 Everything it shows comes from [`swarm-controller`](../../swarm-controller/README.md).
 An agent created here or with `swarmctl agent create` starts `paused`; set it
@@ -21,8 +21,8 @@ An agent created here or with `swarmctl agent create` starts `paused`; set it
 
 ### Linking external accounts
 
-Each agent on `/agents` opens two dialogs that write a credential for it
-into the swarm secret store through swarm-controller. Both are blind
+Each agent on `/agents` opens three dialogs that write a credential for it
+into the swarm secret store through swarm-controller. All three are blind
 set/update actions: no route lists linked accounts or hands a token back.
 
 - **link a matrix account** — `PUT /api/hives/{hive}/agents/{agent}/matrix-accounts/{account}`,
@@ -36,6 +36,14 @@ set/update actions: no route lists linked accounts or hands a token back.
   `hive-forge -f <label>` reads. The unit never deletes a pair: linking
   the same label again overwrites both files, and a pair whose label the
   store doesn't list stays untouched.
+- **link a github account** — `PUT /api/hives/{hive}/agents/{agent}/github-account`
+  with a personal access token, stored at `swarm/agents/<agent>/github-token`.
+  One token per agent: linking again replaces it. The agent's
+  `hive-agent-github-token` unit fetches it into `<state>/github-token`,
+  the file its `gh` wrapper, git credential helper and GitHub notification
+  poller read. A `github-token` already in place stays when the store holds
+  none. What the token needs and how the agent uses it:
+  [GitHub accounts](../integrations/github.md).
 
 Where each credential lives and who reads it:
 [`credentials.md`](credentials.md).