Add controller-owned GitHub read token issuance

[freeqaz-openai]

This PR adds the GitHub App implementation of TokenIssuerV1 for bounded repository reads. Trusted construction fixes one repository and read permissions; callers receive an opaque custody handle without receiving the App signing key or token bytes.

The concrete implementation belongs to apps/controller/src/providers/token/github, with a curated directory entry point for controller composition. The provider-neutral issuer, revoker, attempt/result, and token-handle contracts stay in @openclaw-enterprise/contracts; OCC no longer exports or depends on the GitHub implementation.

• Keep access narrow. Mint requests cannot expand the selected repository or permissions. Returned credentials with unexpected scope or expiry are refused.
• Keep cleanup accountable. Recognizable tokens reach custody even when validation fails. Unknown outcomes require reconciliation, and a separate revoker can clean up retained tokens after the App signing key becomes unavailable.
• Keep responsibilities separate. The factory composes focused modules for attempt lifecycle, HTTPS transport, response validation, mint/revoke operations, and JWT material. Moving those modules into the controller preserves their behavior.

Solid arrows show implemented source connections; dashed arrows show production integration still required. The GitHub connection has not been verified against the live service.

---
config:
  theme: base
  htmlLabels: true
  themeVariables:
    fontSize: 14px
    primaryTextColor: "#344054"
    lineColor: "#8B949E"
    edgeLabelBackground: "#FFFFFF"
    clusterBkg: "#FAFBFC"
    clusterBorder: "#D8DEE6"
  flowchart:
    curve: linear
    nodeSpacing: 28
    rankSpacing: 32
    padding: 14
    diagramPadding: 12
    subGraphTitleMargin:
      top: 10
      bottom: 14
---
flowchart TB
  subgraph Source["Implemented in this PR"]
    Scope["<b>Fixed read scope</b><br/>One repository"] -->|constrain| Issuer["<b>GitHub token issuer</b><br/>Issue and clean up"]
  end
  Issuer -->|issue and revoke| GitHub["<b>GitHub App API</b><br/>Installation tokens"]
  Startup["<b>Production startup</b><br/>Pending connection"] -.->|construct| Issuer
  Agent["<b>Agent repository read</b><br/>Pending caller"] -.->|request access| Issuer
  Issuer -.->|retain securely| Custody["<b>Durable token custody</b><br/>Pending integration #141"]

  classDef configuration fill:#EDF2F7,stroke:#879AB0,color:#25364A,stroke-width:1px
  classDef external fill:#F1EEF5,stroke:#A091AD,color:#3A3243,stroke-width:1px
  classDef operation fill:#EBF3F0,stroke:#7F9D93,color:#2B4038,stroke-width:1px
  classDef pending fill:#F3F4F6,stroke:#98A2AE,color:#44505F,stroke-width:1px,stroke-dasharray:4 4
  class Scope configuration
  class GitHub external
  class Issuer operation
  class Startup,Agent,Custody pending
  style Source fill:#FAFBFC,stroke:#D8DEE6,stroke-width:1px
  linkStyle default stroke:#8B949E,stroke-width:1px

Loading

This PR is limited to the contract and controller-owned implementation. Production startup, protected durable custody (#141), and the regular Agent repository-read caller remain unconnected. Enabling repository reads requires those connections and workflow evidence for successful reads, scope denial, and cleanup after interrupted reads.

Validation on the refreshed revision:

• 53 local HTTPS/RSA protocol tests passed, with zero skips. These execute the real issuer, material, and transport against a local HTTPS peer with disposable keys and test-owned custody.
• Formatting, documentation length, workspace boundaries, CI suite registration checks, and the full workspace TypeScript build passed locally.
• Hosted CI is required for this refreshed revision before merge. Live GitHub compatibility, protected production custody, and regular Agent execution remain unverified.

Related requirements: #86, #106, #107.

[kevinslin]

looking at pr 136 - we're calling this a githubapp provider but a provider means a specific thing in oce (auth client for drivers): https://github.com/openclaw/openclaw-enterprise/blob/main/docs/reference/providers.md#L16

see https://github.com/openclaw/openclaw-enterprise/blob/main/apps/controller/src/providers/chatgpt.ts#L1 as example

github app tokens probably need a new primitive (eg. token issuer). it can be used when a driver boots up (eg. secretbroker can load a GitHubAppIssuer)

can we workshop this so that we design a primitive along with the github app provider?
also - in general, we prefer integration test over unit test. can this also have an integration test using a real github app key? see https://github.com/openclaw/openclaw-enterprise/blob/main/docs/testing/slack.md#L48 for example

[kevinlin-openai]

The concrete GitHub App token provider should follow the controller's provider directory layout and live under:

apps/controller/src/providers/token/github/

Please move the implementation and its GitHub-specific helpers out of packages/occ/src/github-app-provider-v1/ into that directory. Keep provider-neutral TokenIssuer contracts in their shared contract owner, and update the affected composition, exports/imports, tests, and documentation.

This is a provider ownership/layout requirement, not just a rename of the existing OCC directory.