docs(#1970): document githubAccount + gh/git integration + hivectl github set-token

docs/tools/hivectl.md

@@ -75,6 +75,25 @@ hivectl matrix invite @mara:server --room '#hive-chat:server'  # ...or to a spec
   invite power (it owns the hive Space, so that case always works).
   Idempotent — already-member / already-invited is a no-op.
 
+## GitHub
+
+Write an operator-supplied GitHub personal access token (PAT) into an
+agent's token file so its `gh` wrapper + git credential helper can act as
+the configured bot account. Unlike forge/matrix there is no account
+creation — the PAT is for an existing GitHub account. The agent must
+declare [`hyperhive.githubAccount`](../github.md).
+
+```bash
+hivectl github set-token damocles --token-stdin   # paste the PAT on stdin (preferred)
+hivectl github set-token damocles --token <pat>    # inline (visible in shell history)
+```
+
+- `set-token`: writes `<state>/github-token` (`0600`, agent-owned) via
+  hive-priv — the same credential-injection path as forge/matrix tokens.
+  The `gh` wrapper / git credential helper read it live, so a freshly-set
+  or rotated PAT takes effect with no rebuild or restart. Refuses an empty
+  token. See [github.md](../github.md) for the full flow + security notes.
+
 ## Gateway
 
 Manage users in the gateway's HTTP Basic auth htpasswd file