github: PATs live in swarm bao; the agent fetches them itself

An operator links an agent's GitHub personal access token in the swarm UI
(LinkGithubAccountForm, "link github account" on /agents). swarm-controller's
PUT /api/hives/{hive}/agents/{agent}/github-account stores it at
swarm/agents/<agent>/github-token (swarm_secret_client::github), a flat leaf
under the agent's prefix that the agent's existing read grant already covers:
no policy change, and no list grant, since there is one token per agent.

In the agent, hive-agent-github-token (oneshot + 2-minute timer, as the agent
user, under its own store certificate, ordered before hive-github-notify)
reads that path and writes <state>/github-token, 0600 and agent-owned, the
file the gh wrapper, git credential helper and hive-github-notify already
read. It replaces the file by rename only when the bytes changed and never
deletes it: a hive-written github-token stays until a token is linked in the
swarm UI. It is installed only with a store address and
services.hyperhive.agent.github.enable.

Removed: the dashboard's CR3D3NTIALS page (credentials.html/js/css, its
build entries and H0M3 tile; GITHUB was its only tab), hive-c0re's
dashboard/matrix_accounts.rs with GET/POST /api/github-account,
priv_client::write_agent_github_token, the host socket's
SetAgentGithubToken and `hivectl github set-token`, and hive-priv's
WriteAgentGithubToken with write_agent_state_file, its only caller gone.

Docs: integrations/github.md and swarm/ui.md describe the swarm path,
swarm/credentials.md gains the store-path row, and the hive UI docs,
hivectl docs and security.md's hive-priv table drop the removed pieces.

Closes #4347

docs/tools/hivectl-cli.md

@@ -9,8 +9,6 @@ This document contains the help content for the `hivectl` command-line program.
 * [`hivectl forge reconcile-config`↴](#hivectl-forge-reconcile-config)
 * [`hivectl matrix`↴](#hivectl-matrix)
 * [`hivectl matrix invite`↴](#hivectl-matrix-invite)
-* [`hivectl github`↴](#hivectl-github)
-* [`hivectl github set-token`↴](#hivectl-github-set-token)
 * [`hivectl gateway`↴](#hivectl-gateway)
 * [`hivectl gateway create-user`↴](#hivectl-gateway-create-user)
 * [`hivectl gateway delete-user`↴](#hivectl-gateway-delete-user)
@@ -64,7 +62,6 @@ Sibling to the `hive-c0re` daemon binary. Covers host-side admin operations that
 
 * `forge` — Reconcile an agent's config between this hive and the forge
 * `matrix` — matrix-tuwunel invites
-* `github` — GitHub account provisioning
 * `gateway` — Gateway htpasswd user management
 * `agent` — Lifecycle actions on ONE managed agent container. Needs the hive-c0re daemon running
 * `list-agents` — Show all managed agents with their status and technical state
@@ -156,39 +153,6 @@ Invite a matrix user to the hive Space, or a specific room with `--room`. Idempo
 
 
 
-## `hivectl github`
-
-GitHub account provisioning.
-
-Store an operator-supplied personal access token (PAT) for an agent so its `gh` and git can authenticate. Creates no account — the PAT is for an existing GitHub account.
-
-**Usage:** `hivectl github <COMMAND>`
-
-###### **Subcommands:**
-
-* `set-token` — Store a GitHub PAT for `<agent>` so its `gh` and git can authenticate
-
-
-
-## `hivectl github set-token`
-
-Store a GitHub PAT for `<agent>` so its `gh` and git can authenticate.
-
-Prefer `--token-stdin` — an inline `--token` is visible in shell history.
-
-**Usage:** `hivectl github set-token [OPTIONS] <AGENT>`
-
-###### **Arguments:**
-
-* `<AGENT>` — Logical agent name (the container/agent name)
-
-###### **Options:**
-
-* `--token <TOKEN>` — The PAT value inline. Mutually exclusive with `--token-stdin`
-* `--token-stdin` — Read the PAT from stdin (trailing newline stripped). Mutually exclusive with `--token`
-
-
-
 ## `hivectl gateway`
 
 Gateway htpasswd user management.