Improve Forge auth error guidance for PR flow

[mrychlik]

Motivation

• Users hit opaque "bad credentials" errors when invoking the PR flow through Forge and need actionable guidance for configuring GitHub credentials for ghub/Forge.
• Provide a clearer failure path so the PR flow surfaces a helpful message instead of a raw backend error.

Description

• Add agentic--forge-credentials-help which returns concise setup instructions for storing a GitHub Personal Access Token in auth-source (example ~/.authinfo.gpg) and notes M-x ghub-create-token as an option.
• Add agentic--signal-forge-auth-error which matches common auth error patterns (bad credentials, 401, 403) and raises a user-facing error that includes the credential setup help.
• Wrap the forge-create-pullreq call inside agentic/forge-open-pr with condition-case to route credential failures through the new helper and update the function docstring to mention the credential dependency.

Testing

• Searched the source to confirm the new helpers and usages via rg -n "agentic--forge-credentials-help|agentic--signal-forge-auth-error|forge-open-pr|forge-create-pullreq" agentic.el and verified hits succeeded.
• Inspected the updated section of agentic.el to verify the messaging, error matching, and condition-case wrapping were implemented as intended.
• Attempted an emacs --batch runtime check but it could not be executed in the current environment because emacs is not installed, so runtime validation was not performed.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ef8d031427

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict auth classification to credential-specific failures

Matching on bare 403 causes non-auth GitHub failures (for example rate limiting or repository authorization errors) to be rewritten as credential setup problems, which hides the real cause and sends users toward the wrong fix. This regression is introduced in the new auth helper, where any message containing 403 is treated as bad credentials.

Useful? React with 👍 / 👎.