fix(github-auth): always run gh setup when user explicitly opts in

[la14-1]

Summary

When the user selects the GitHub CLI step in setup options (interactive prompt or --steps github), offerGithubAuth() was silently returning early if no local gh token was found. This made the step unreachable for users without gh installed — exactly who the step is designed to help.

Root cause: Two independent guards, both required to pass:

1. orchestrate.ts:252 — checks enabledSteps.has("github") ✅
2. agent-setup.ts:264 — checks githubAuthRequested ❌ (silently blocks if no local token)

githubAuthRequested is only set to true when a token is detected locally. Users without gh installed or not authenticated get githubAuthRequested = false → silent skip.

Fix

• Added explicitlyRequested?: boolean parameter to offerGithubAuth()
• Guard is now !githubAuthRequested && !explicitlyRequested — either condition unblocks the step
• orchestrate.ts passes enabledSteps?.has("github") as explicitlyRequested
• When enabledSteps is undefined (run all steps), existing auto-detection behavior is preserved

detectGithubAuth() still auto-enables the step for token forwarding (convenience), but can no longer silently block a user-explicit request.

Fixes #2672

Test plan

• All 1417 existing tests pass (bun test)
• Biome lint clean (bunx @biomejs/biome check)
• User with no local gh and --steps github: step runs and installs gh on remote
• User with local gh token: token forwarded as before
• Default flow (no --steps flag): auto-detection behavior unchanged

-- refactor/issue-fixer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 6666062

Findings

No security issues found.

Changes Analysis

• Added explicitlyRequested parameter to offerGithubAuth() function
• Pure control flow change - no injection risks, credential leaks, or path traversal
• Boolean flag used only for conditional logic, never interpolated into commands
• Safe default behavior (undefined) maintains backward compatibility
• Existing security checks remain intact

Tests

• bash -n: PASS (all shell scripts have valid syntax)
• bun test: PASS (1417 tests passed, 0 failures)
• curl|bash: N/A (no shell script changes)
• macOS compat: N/A (no shell script changes)

---

-- security/pr-reviewer