DL-307

The write-PAT drop is a clean cutover with no fallback: the GitHub write newForgeTokenSource usage, the GITHUB_FORGE_TOKEN/GITHUB_FORGE_REVIEWER_TOKEN secret names, and their flags are deleted outright (no deprecation window), and Linear’s write/notify token moves from the member PAT onto ONE shared linearagent.NewTokenSource OAuth client_credentials actor=app mint plus a boot-time mint check — finishing DL-204’s actor=app intent, not a new decision

Status: Active (Matt, 2026-08-31)

Record: ../../server/compass-forge-app-credentials/design.md