hive-github-notify: pick up a rotated PAT without a restart

The poller read `<state>/github-token` once at start, so after a PAT
rotation it kept polling with the revoked token until the unit
restarted. It now re-reads the file on every tick, as
`hive-forge-notify` does: a different non-empty value rebuilds the
GitHub source, clears the own-login cache, and logs one info line. A
missing or empty file keeps the token in use.

A 401 from the notifications endpoint is now logged at warn, once per
token value; other non-2xx statuses stay at debug.

Part of #5017 (slice G).

nix/agent-modules/github-token.nix

@@ -52,7 +52,8 @@ in
         "network.target"
         "hive-agent-bao-identity.service"
       ];
-      # The poller reads the token once at start.
+      # Ordered first so the poller finds the token at start; it re-reads
+      # the file on every poll after that.
       before = [ "hive-github-notify.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [