docs(#1970): document githubAccount + gh/git integration + hivectl github set-token

README.md

@@ -118,6 +118,20 @@ The hive-internal account is always named `main` (synthesized from `hyperhive.ma
 
 For more details see [`docs/matrix.md`](docs/matrix.md).
 
+### GitHub account
+
+`hyperhive.githubAccount` gives an agent a managed GitHub identity — a `gh` CLI wrapper and `git push` over HTTPS, both authenticated as a configured bot account:
+
+```nix
+hyperhive.githubAccount = {
+  username = "the-sword-above";
+  tokenFile = "/agents/myagent/state/github-token";  # PAT provisioned out-of-band
+  # host = "github.com";                              # default; set for GHE
+};
+```
+
+The PAT value is never in nix; write it with `hivectl github set-token <agent> --token-stdin`. Both the `gh` wrapper and the git credential helper read the token live, so a rotated PAT takes effect with no rebuild. Single account per agent. For more details see [`docs/github.md`](docs/github.md).
+
 ## Operator CLI
 
 `hivectl` is the operator-facing host CLI for ad-hoc administration that