DL-441

The GitHub App is the only GitHub credential in every tier and on every host (Matt, RIG-4436 OQ-6): no PAT path for Beta or Dogfood; a user-declared GitHub (SecretGH) credential is never delivered to an agent, with or without the App, and declaring one is rejected; the brokered App token is the only SecretGH an agent receives

Status: Active (Matt, 2026-10-10)