fix(cloud-agent-next): diagnose GitHub upstream quotas

[eshurakov]

Summary

• Add bounded, secret-safe diagnostics for managed GitHub 403/429 responses.
• Include safe rate-limit evidence and GitHub redemption context without exposing tokens or bodies.
• Return optional redemption metadata for staged token-service rollouts.

Verification

• pnpm --filter cloud-agent-next exec vitest run src/github-rate-limit-diagnostics.test.ts src/sandbox-outbound.test.ts (130 passed)
• pnpm --filter cloudflare-git-token-service exec vitest run src/index.test.ts (197 passed)
• Cloud Agent and Git token service typechecks passed.
• Cloud Agent and Git token service linters passed.
• Cloud Agent formatting check and git diff --check passed.

No deployment or live-session testing was performed.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (7 files)

• services/cloud-agent-next/src/github-rate-limit-diagnostics.ts
• services/cloud-agent-next/src/github-rate-limit-diagnostics.test.ts
• services/cloud-agent-next/src/sandbox-outbound.ts
• services/cloud-agent-next/src/sandbox-outbound.test.ts
• services/cloud-agent-next/src/types.ts
• services/git-token-service/src/index.ts
• services/git-token-service/src/index.test.ts

---

_{Reviewed by grok-4.6 · Input: 182.9K · Output: 14.6K · Cached: 568.7K}

_{Review guidance: REVIEW.md from base branch main}