fix(github-auth): check ~/.hermes/.env before ~/.git-credentials for token extraction

[Mibayy]

Fixes #3464

Problem

Users who configure GitHub via hermes setup have their token saved to ~/.hermes/.env (as GITHUB_TOKEN=...), but the auth detection code in all GitHub skills only checked ~/.git-credentials. On macOS with the default osxkeychain credential helper (and on any system where the store helper isn't in use), ~/.git-credentials doesn't exist, so the extraction silently returns an empty string and all API calls get a 401 — with no warning to the user.

Fix

In all 5 affected skill files, add ~/.hermes/.env as the first fallback (before ~/.git-credentials) in the token extraction logic. The priority order is now:

1. gh CLI (command -v gh && gh auth status)
2. $GITHUB_TOKEN already set in the environment
3. ~/.hermes/.env — token stored by hermes setup (new)
4. ~/.git-credentials — git store helper (existing fallback)
5. AUTH_METHOD=none

Files changed

• skills/github/github-auth/SKILL.md — "Helper: Detect Auth Method" block + inline "Extracting the Token from Git Credentials" example
• skills/github/github-code-review/SKILL.md — inline token extraction
• skills/github/github-pr-workflow/SKILL.md — inline token extraction
• skills/github/github-issues/SKILL.md — inline token extraction
• skills/github/github-repo-management/SKILL.md — inline token extraction

Diff pattern (github-auth Helper block)

 elif [ -n "$GITHUB_TOKEN" ]; then
   echo "AUTH_METHOD=curl"
+elif [ -f ~/.hermes/.env ] && grep -q "^GITHUB_TOKEN=" ~/.hermes/.env; then
+  export GITHUB_TOKEN=$(grep "^GITHUB_TOKEN=" ~/.hermes/.env | head -1 | cut -d= -f2 | tr -d '\n\r')
+  echo "AUTH_METHOD=curl"
 elif grep -q "github.com" ~/.git-credentials 2>/dev/null; then
   export GITHUB_TOKEN=$(grep "github.com" ~/.git-credentials | head -1 | sed 's|...|')
   echo "AUTH_METHOD=curl"

Diff pattern (4 skill inline blocks)

   if [ -z "$GITHUB_TOKEN" ]; then
-    GITHUB_TOKEN=$(grep "github.com" ~/.git-credentials 2>/dev/null | head -1 | sed 's|...|')
+    if [ -f ~/.hermes/.env ] && grep -q "^GITHUB_TOKEN=" ~/.hermes/.env; then
+      GITHUB_TOKEN=$(grep "^GITHUB_TOKEN=" ~/.hermes/.env | head -1 | cut -d= -f2 | tr -d '\n\r')
+    elif grep -q "github.com" ~/.git-credentials 2>/dev/null; then
+      GITHUB_TOKEN=$(grep "github.com" ~/.git-credentials 2>/dev/null | head -1 | sed 's|...|')
+    fi
   fi