[Pavilion-devs]

Root cause

OAuth2 Proxy creates a GitHub session by resolving the authenticated user organization list even when no organization allowlist is configured. The reduced user:email token made that GitHub API call return 403, which OAuth2 Proxy surfaced as a callback 500.

Fix

• restores the minimum provider-compatible scope: user:email read:org
• keeps authentication open to every GitHub account
• keeps unknown users read-only inside GlassBox
• documents why read:org is operationally required
• adds a production configuration regression assertion

Verification

• reproduced the 500 through the real GitHub OAuth callback
• confirmed the GitHub 403 in production OAuth2 Proxy logs
• production-edge tests pass 5/5