feat(github): gist scope + github.identityProof.create/delete

[panghy]

Stack order — 16/22 of the intentd multiplayer stack. Base: #1963 (feat/invite-accept-returning-guest) · Next: #1967 (feat/invite-challenge-prove).
Review only this PR's own commits (feat/invite-accept-returning-guest..feat/github-identity-proof); everything below is reviewed in its own PR.
Merge intent: the stack lands bottom-up in chain order through the merge queue, one PR at a time — this PR merges only after #1963 has landed. The whole intentd stack merges before the cloudlands-fe multiplayer stack (protocol rule: daemon side first); the cloudlands-fe stack must not be merged, auto-merge-armed, or queued until the intentd stack is merged.

Summary

Guest half of the gist identity-proof join flow: the local daemon can create and delete a secret proof gist with the user's own stored GitHub token, so a host can verify that the joining guest controls the GitHub account.

Changes

• intent-sourcecontrol
  • device_flow::DEFAULT_SCOPES gains gist (repo, read:org, workflow, gist). Tokens granted before keep working; only the proof needs a re-authorization.
  • New identity_proof module: create_proof_gist(token, api_base, nonce, host_label) -> { gist_id, login } — GET /user first, checks X-OAuth-Scopes for gist (typed ScopeMissing), then POST /gists with public: false and a single intent-join-proof.txt (<nonce>\n<explanatory line naming the host>\n); delete_proof_gist(token, api_base, gist_id) — DELETE /gists/{id}, 404 treated as success (idempotent). Typed IdentityProofError { ScopeMissing, Unauthorized, Unreachable, Other }.
• intent-core: Error::IdentityProof(IdentityProofErrorKind) with the bounded wire codes github-not-connected / github-scope-missing / github-unreachable (numeric -32603, error.data = { code }); two new WorkspaceApi trait methods.
• intent-services: github_identity_proof_create(nonce, hostLabel) / github_identity_proof_delete(gistId) — administrator-gated (refused on the collaborator surfaces), stored sourceControl.github.token only (env / gh fallbacks never consulted), params validated as trimmed single lines / alphanumeric gist id (-32602), API base via the existing INTENTD_GITHUB_API_BASE_URI seam. A token GitHub rejects maps to github-not-connected (same remedy).
• intent-transport: github.identityProof.create / github.identityProof.delete registered in the catalog + router next to github.getUser; identity-proof errors carry error.data.code.

Wire surface

Method	Params	Result
github.identityProof.create	nonce (req), hostLabel (req)	{ gistId, login }
github.identityProof.delete	gistId (req)	{ ok: true } (idempotent)

Refusals: -32603 with error.data.code ∈ github-not-connected | github-scope-missing | github-unreachable; -32602 for bad params.

Protocol docs (docs/protocol/methods/integrations.md §5.27, 09-error-codes.md) are updated on the monorepo side alongside this PR.

Tests

• intent-sourcecontrol: mock-server unit tests for create (scopes ok), scope-missing, unauthorized, delete live / 404 / unreachable, proof content format.
• intent-services: services-layer tests (stored token happy path create+delete, no token → not-connected, missing scope, dead host → unreachable, param validation before token load) + error-mapping unit tests.
• intent-transport: router param/dispatch tests + error.data.code shape; catalog test updated.
• intentd WSS e2e (e2e_wss_github_device_flow.rs::github_identity_proof_create_and_delete_over_wss): seeded secrets file + mock API host → create returns { gistId, login }, delete idempotent, -32602 on missing params, github-scope-missing without the scope, github-not-connected after github.revoke.

Gates

• cargo fmt --check ✅, cargo clippy --workspace --all-targets -- -D warnings ✅, cargo test --workspace --test '*_lint' ✅
• cargo nextest run -p intent-core -p intent-sourcecontrol -p intent-services -p intent-transport → 6063 passed
• cargo nextest run -p intentd -E 'binary(e2e_wss_github_device_flow) | binary(wss_integration) | test(catalog)' → 174 passed

Not in scope: host-side challenge/prove, client changes, github.authStatus semantics.

[augmentcode]

^{Deep Code Review Agent🐛}

Review completed with 0 suggestions.

_{Reviewed commit: ac2bfbf}

[augmentcode]

🤖 Augment PR Summary

Summary: Adds the guest-side GitHub gist identity-proof flow for multiplayer joins.

Changes:

• Requests the gist OAuth scope during GitHub device authorization.
• Adds source-control helpers to check the token owner and scopes, create a secret proof gist, and delete it idempotently.
• Introduces bounded identity-proof error kinds and serializes their stable codes in JSON-RPC error data.
• Adds github.identityProof.create and github.identityProof.delete to the workspace API, router, and method catalog.
• Uses only the stored device-flow token and administrator authorization for both operations.
• Validates proof text inputs and gist IDs before invoking GitHub.
• Covers source-control, service, router, catalog, and real WSS transport paths with tests.

Technical Notes: Proof creation verifies X-OAuth-Scopes before publishing a single-file non-public gist and returns only its ID plus the authenticated login.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.