AMS git operations resolve a GitHub token from the loopover-mcp session (one login for both ORB and AMS)

[JSONbored]

Problem

AMS's git operations authenticate via a plain GITHUB_TOKEN env var (packages/loopover-miner/lib/attempt-cli.js:138,318 and siblings) — a manually-created PAT, set up separately from loopover-mcp login. Once #[persist-token issue] exists, loopover-mcp can fetch a real GitHub token for the logged-in session, but nothing in AMS's own code path consumes it yet.

Area

packages/loopover-mcp/bin/loopover-mcp.js (CLI/session handling), packages/loopover-miner/lib/* (wherever env.GITHUB_TOKEN is currently read).

Proposal

• Add a token-resolution step AMS's git-operation code paths call instead of reading process.env.GITHUB_TOKEN directly: check GITHUB_TOKEN first (explicit override stays supported — don't break existing self-host operators who already have a PAT set up), then fall back to fetching a live token from the authenticated loopover-mcp session (via #[persist-token issue]'s new endpoint).
• loopover-mcp login becomes the one command that covers both: the existing loopover session (already used for ORB's MCP tool calls) and, transparently, AMS's git credential.
• Cache the fetched token in memory for the process's lifetime rather than re-fetching per git operation, but don't persist it to disk in a new location — it should live exactly where the loopover session already lives (or be fetched fresh each process start), not duplicated into a second local credential file.
• Update packages/loopover-miner/docs/*.md (whichever file documents the current GITHUB_TOKEN setup) to describe the new one-command flow as the primary path and the manual PAT as the explicit fallback.

Deliverables

• AMS git-operation code resolves a token via GITHUB_TOKEN env override → fall back to the logged-in session's live GitHub token
• loopover-mcp login (device flow) is sufficient, on its own, to run AMS against a repo the user has access to — no separate PAT setup required for the common case
• Docs updated to describe the new primary flow
• Tests: token resolution precedence (env override wins), and the fallback path against a mocked session-token-fetch

Resources

• #[persist-token issue] (this issue is blocked by it)
• packages/loopover-mcp/bin/loopover-mcp.js:2698 (login)
• packages/loopover-miner/lib/attempt-cli.js:138,318 (current env.GITHUB_TOKEN read sites)

Boundaries

This is the piece that actually delivers the "one login, both ORB and AMS" UX goal — the other issues in this milestone are prerequisites for this one. Maintainer-only for now, given it touches the same credential-handling surface as the rest of this milestone.

maintainer-only — assigned JSONbored.

[linear-code]

JSO-4207