fix(sandbox): refresh GitHub installation token for the sandbox lifetime

[cooper (czxtm)]

Problem

GitHub App installation tokens expire after 60 minutes — fixed by GitHub, not extendable (a 4-hour token is not a thing GitHub offers). The sandbox entrypoint minted one once at boot; warm-pool sandboxes claimed >1 h after creation (and sessions outliving the hour) served dead tokens — every GitHub call 401'd. Verified across 16 auto_review jobs on 2026-07-09/10: all credential failures were sandboxes >60 min old at claim (nixmac#514 at 74 min, voy#1130 at 211 min, travel-frens#246 at 60 min); everything claimed fresh posted reviews fine.

Change

1. Background re-mint loop (GITHUB_TOKEN_REFRESH_SECONDS, default 3000 s = 50 min — hourly cadence with margin so a live token always exists): re-mints and atomically rewrites the token file (~/.centaur/github-token, 0600) + git credential store, for the sandbox's whole life (idle-warm and claimed). Fail-soft: a failed re-mint keeps the previous token and retries in 300 s.
2. No env export on the mint path: GITHUB_TOKEN/GH_TOKEN freeze into the exec'd harness at boot and go stale where files can be refreshed — and gh prefers env over everything. A /usr/local/bin/gh wrapper (shadows apt's /usr/bin/gh) re-reads the token file per invocation; both env vars are unset so no stale/stub value can shadow the fresh sources. git reads the refreshed credential store.
3. Legacy path preserved: deployments passing a real GITHUB_TOKEN env with no App creds keep the old behavior (unset is scoped to the mint path; wrapper is a passthrough without the token file; tail auth block pins /usr/bin/gh).

Verification

Functional smoke (stubbed minter, real functions extracted from the entrypoint): boot mint writes 0600 token file + x-access-token credentials ✓; refresh loop re-mints on interval and swaps both files atomically ✓; poisoned minter keeps last token (fail-soft) ✓; wrapper overrides stale env from the file and passes through without it ✓. bash -n/sh -n clean.

Deploy

After merge + image build: bump sandbox.image.tag in gitops apps/centaur.yaml. Warm-pool pods pick the fix up on natural recycle (or delete the current warm pod — its token is already hours dead).