Authenticate GitHub API metadata requests when a token is available

[BrettKinny]

Summary

Unauthenticated GitHub REST calls are limited to 60 requests/hour/IP, so a full setup.sh or sqrbx-update behind a shared NAT or CI can fail with HTTP 403. All in-Box API calls (tool releases, LazyVim / Oh My Zsh / PowerShell lookups in setup.sh) go through _sb_gh_api_get in scripts/lib/tool-lib.sh, which now optionally authenticates.

• Token source precedence: GH_TOKEN, then GITHUB_TOKEN, then gh auth token. The gh step runs only when gh is installed and already logged in, and only for the default https://api.github.com base. It runs lazily, at most once per shell, with GH_PROMPT_DISABLED=1 and stdin from /dev/null, so it never prompts.
• Scope: Authorization: Bearer is sent only when the URL is under the configured SB_GITHUB_API_BASE and that base is https://. Artifact downloads never get the header. curl does not forward a custom Authorization header to a different host when following a redirect, and we don't pass --location-trusted.
• No argv exposure: the header reaches curl as a config here-string on stdin (curl -K - ... <<<'header = "..."'). Tokens must match ^[A-Za-z0-9_.-]+$, so the value can't inject curl config. A malformed token is ignored with a warning that does not print it.
• No persistence: the token is never logged, never put in error messages, and never written to the metadata cache (the cache still stores only response bodies keyed by URL).
• HTTP 401: warns, drops the token for the rest of the shell, and retries once without authentication.
• HTTP 403/429 without a token: the error now suggests GH_TOKEN or gh auth login.
• Fail-closed metadata, digest and caching behaviour is unchanged.
• install.sh and install.ps1 are unchanged.

README (Update section) and SECURITY.md (Download trust) are updated.

Tests

New cases in tests/test-tool-lib.sh use a mock curl that records argv and stdin config. They cover:

• the header is sent when GH_TOKEN is set
• GITHUB_TOKEN is used when GH_TOKEN is unset
• no header when no token is set, and gh is not consulted for a custom base
• the token is absent from curl argv, from output, and from the metadata cache
• artifact downloads never carry the token
• no token is sent to a non-HTTPS base
• HTTP 401 retries once unauthenticated, warns, and drops the token
• an unauthenticated 403 fails closed and shows the hint
• the gh auth token fallback is resolved once
• a malformed token is ignored without being printed

The full host suite (19 files) passes, both with GH_TOKEN unset and with it set.

🤖 Generated with Claude Code