fix bootstrap sandbox gh diagnostic

[lmuehleisen]

Intent

Distinguish a real missing GitHub login from the Codex sandbox case where host GitHub credentials and network access are not directly available to the startup check.

Changes

• Add HOST_GH_ACCESS_REQUIRED for sandboxed gh auth probe failures.
• Preserve NEEDS_GH_AUTH outside the sandbox.
• Document the handling in AGENTS.md and README.md.
• Add focused bootstrap tests for both auth-failure paths.

Validation

• bash tests/fm-bootstrap.test.sh
• bash tests/fm-afk-inject-e2e.test.sh (exited 0; skipped pane-input check in this sandbox after tmux private-socket errors)
• bash tests/fm-secondmate.test.sh
• bash tests/fm-spawn-batch.test.sh
• bash tests/fm-teardown.test.sh
• bash tests/fm-wake-queue.test.sh
• no-mistakes run 01KVV4WNRW9D1ZP7VZJNFSNR6Y: checks-passed