Add local GitHub auth mode for codespace sessions

[ekroon]

What

• add an explicit --github-auth codespace|local launcher option while keeping codespace as the default
• thread the selected GitHub auth mode through SSH execution, tmux-backed sessions, exec-agent execution, rewritten MCP servers/hooks, open_shell, lifecycle-created codespaces, and --resume
• add a local proxy helper so rewritten configs and hook files carry auth mode metadata instead of serializing local token values
• expand tests and update README usage/docs for the new auth mode

Why

The current .env-secrets bootstrap fix is correct and should stay the default, but there was no supported way to explicitly prefer a local GITHUB_TOKEN / GH_TOKEN for a session when that behavior is desired.

How

• introduced shared auth-mode helpers in internal/codespaceenv for parsing, local token resolution, normalization, and host derivation
• made ssh.Client mode-aware so normal SSH execution and tmux-backed async sessions apply the same precedence rules
• persisted the selected auth mode in workspace resume metadata and propagated it through MCP/lifecycle wiring
• kept explicit per-command env overrides higher precedence than session auth

Testing

• go build ./cmd/gh-copilot-codespace
• go vet ./...
• go test -race ./...

Notes

• --github-auth local fails early unless local GITHUB_TOKEN or GH_TOKEN is set
• local mode does not write the token into workspace manifests, MCP config JSON, or rewritten hook files
• remaining tradeoff: the token may still briefly exist in descendant local process args/env while gh codespace ssh startup happens