feat(gh): route pipeline PR creation through a configurable credential

[quinnbot-ai]

Intent

Give firstmate a supported way to route the no-mistakes pipeline's PR-creation step through a credential authorized for createPullRequest, instead of the pipeline using whatever gh resolves from the daemon's environment.

A GitHub fine-grained personal access token is forbidden from the GraphQL createPullRequest mutation. Such a token passes gh auth status and satisfies every REST call the earlier steps make, then fails only at gh pr create with "Resource not accessible by personal access token" - at the end of an otherwise green run.

Investigation: no supported seam exists

Read from the installed no-mistakes v1.41.2 binary and the upstream source at release 1.46.0, commit 20892e6.

• internal/scm/github executes every forge call by the bare name gh, with no binary-path or credential parameter.
• Neither the global config.yaml nor the per-repo .no-mistakes.yaml exposes a GitHub credential, a gh path, or a PR-step command override. agent_path_override covers agent binaries only; commands.* covers lint, test, and format.
• Bitbucket Cloud, by contrast, reads NO_MISTAKES_BITBUCKET_EMAIL, NO_MISTAKES_BITBUCKET_API_TOKEN, and NO_MISTAKES_BITBUCKET_API_BASE_URL. GitHub has no equivalent.
• stepCmd already honors a step-scoped PATH and credential environment whenever StepContext.Env is populated, but pipeline.go declares that field as test-only and the production executor never sets it. The mechanism exists; a supported way to configure it does not.

The installed tool is not patched. Tracking it clean was the governing constraint.

What this adds

• bin/fm-gh.sh runs one command with the credential prefix from a gitignored config/gh-credential. With no such file it execs the command unchanged, so an unconfigured home behaves exactly as before and no machine-specific vault path enters tracked material.
• bin/fm-gh-shim.sh is installed as a symlink named gh. It routes only pr create and pr edit - the two mutations the forbidden token class cannot perform - and delegates everything else, including the pipeline's own pr list and pr view reads, straight to the real gh so the privileged credential is never spent on reads.
• bin/fm-gh-shim-install.sh installs, removes, and verifies PATH precedence. It refuses to overwrite a gh it does not own and refuses to remove a symlink it did not create.

Nothing installs automatically.

A limit stated rather than papered over

Interception cannot be scoped to a task worktree. The PR step runs inside the no-mistakes daemon, whose environment is resolved once from a login-shell probe at startup, so nothing inside a task worktree is on the PATH that resolves gh. Any shim is PATH-wide by construction. docs/no-mistakes-pr-credential.md documents that plainly, which is why installation is explicitly opt-in.

docs/proposals/nm-pr-step-interception.md specifies the upstream configuration seam that would retire the shim, precise enough to become an upstream PR.

Verification

tests/fm-gh-shim.test.sh (11 assertions) drives the shim and wrapper against a fake gh that records its argv and the credential it received. It covers the exact argument vector the PR step builds, credential precedence, pass-through, recursion, installer ownership and precedence, and bash 3.2.

Recorded evidence in docs/verification/gh-pr-credential.md: the ambient token returns FORBIDDEN on a createPullRequest probe, while the wrapped credential passes authorization and fails only on nonexistent refs (UNPROCESSABLE). Nothing was created by the probe.

The mechanism was also exercised end to end: this change's own upstream pull request was opened by the pipeline's PR step while the shim held precedence.

Relationship to upstream

kunchenguid/firstmate#1858 carries this same change upstream and remains open as the pure-upstream proposal, together with the config-seam document. That PR's CI is held at action_required pending maintainer approval, which is why this fork-side pull request exists: it lets the fleet land the fix without waiting on upstream.

Two behavioral notes for review:

• gh gives GH_TOKEN precedence over GITHUB_TOKEN, so the wrapper clears both before running a configured prefix; otherwise an ambient GH_TOKEN would silently defeat the injected credential. The unconfigured pass-through path is left untouched.
• One commit adapts the suite's fixture-root handling to this branch's base, where a cleanup trap can remove the temporary directory before it is used.