Add offline GitHub-token and coding-agent-credential presence checks to `gittensory-miner doctor`

[JSONbored]

Context

gittensory-miner doctor's checks in packages/gittensory-miner/lib/status.js currently make zero network calls (a documented invariant) but never verify that GITHUB_TOKEN is actually set, nor that the credential required by whichever MINER_CODING_AGENT_PROVIDER is configured (an API-key env var, or an auth-file path for claude-cli/codex-cli) is present. As a result, an operator can pass doctor cleanly and then have their first real attempt fail mid-run purely on a missing credential.

Dependencies

None — independently shippable. This reads MINER_CODING_AGENT_PROVIDER directly (the same env var the provider-gating issue in this batch reads) but does not require that issue to land first; it can be implemented against the raw env var value on its own.

Requirements

1. Extend runDoctorChecks() in packages/gittensory-miner/lib/status.js with new checks for credential presence.
2. Add a check that GITHUB_TOKEN is set and non-empty — no API call, string presence/length check only.
3. Read the configured MINER_CODING_AGENT_PROVIDER and add a check for the credential that specific provider requires: an API-key env var presence check for agent-sdk-style providers, or an auth-file existence/readability check (mirroring the existing checkCodexCliPresent/checkClaudeCliPresent presence-check helpers) for claude-cli/codex-cli.
4. All new checks must make zero network calls, preserving doctor's documented no-network invariant exactly as it exists today.
5. Report a clear, specific failure message identifying which credential is missing, before a real attempt would fail mid-run on it.
6. Never print or log the credential's actual value — presence/boolean and file-path/env-var-name only.

Deliverables / Acceptance Criteria

• New GITHUB_TOKEN presence check added to runDoctorChecks()
• New per-provider credential presence check added, keyed off MINER_CODING_AGENT_PROVIDER
• Confirmed no network call is introduced anywhere in the new checks
• Clear, provider-specific failure messages on missing credentials
• No secret values ever printed by the new checks

Test Coverage Requirements

This PR must ship with full test coverage for every changed line and branch — the repo's Codecov patch gate requires 99%+ coverage and the house standard is to aim for 100%, including both sides of every conditional/nullish-coalescing branch introduced. Add: (1) unit tests covering both the success path (token/credential present) and failure path (token/credential missing or empty) for each provider value, (2) an invariant test asserting doctor's output never contains the actual token/credential value, only presence booleans and env-var/file-path names, and (3) a regression test if this is treated as closing a real gap (an attempt failing mid-run on a credential doctor should have caught).

Codecov visibility note: packages/gittensory-miner/**, apps/gittensory-miner-ui/**, and apps/gittensory-miner-extension/** currently sit entirely outside vitest's coverage.include glob, so codecov/patch cannot measure changes there yet — closing that gap is exactly what #4864 and #4865 (in this same milestone) do. Any part of this change under packages/gittensory-engine/src/** or the repo's own src/** remains fully Codecov-instrumented as usual. Either way, this does not lower the bar: treat the 100%-including-invariants-and-regression target above as the enforced house standard regardless of what Codecov can currently see, and it becomes gate-enforced for real once #4864/#4865 ship.

Expected Outcome

An operator running doctor before starting discovery/attempts will be told upfront if their GITHUB_TOKEN or configured coding-agent credential is missing, instead of discovering it only when a live attempt fails partway through.

Links & Resources

• packages/gittensory-miner/lib/status.js
• packages/gittensory-miner/lib/laptop-init.js (existing presence-check helper pattern to reuse)
• See Make doctor validate config content, not just its path #4873 (a distinct check validating .gittensory-miner.yml config content, not credential presence)
• Theme: Claude/Codex self-host operational parity

[linear-code]

JSO-3707