fix: Authenticate GitHub App Git Operations

[danny-avila]

Summary

I fixed native BYOM GitHub App authentication for Git-over-HTTPS. GitHub rejects installation tokens sent as Bearer authorization for Git transport, even though the same tokens work for REST API requests.

• Encode the installation token as the standard x-access-token Basic credential before handing it to the masked SRT environment.
• Send the masked credential using an Authorization: Basic extra header for Git commands.
• Preserve the existing boundary where the raw token is absent from repository URLs, Git configuration files, and sandbox-visible environment variables.
• Add focused regression coverage for the encoded credential and Basic authorization wrapper.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• Reproduced the failure against a real GitHub App installation: Bearer returned Git exit 128, while Basic returned the expected remote HEAD.
• Ran the focused GitHub credential and native-sandbox credential tests.

Test Configuration:

• Node.js 24.16.0
• GitHub App installation token
• Anthropic Sandbox Runtime native BYOM path

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[danny-avila]

@codex review

Please review the current PR head c69a554. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T03:19:19.277249Z	c69a554	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: c69a554d4c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".