Add an opt-in `gittensory-miner init --verify-token` flag to validate GITHUB_TOKEN scopes via a single API call

[JSONbored]

Context

gittensory-miner's init command sets up the local state directory today but never confirms the operator's GITHUB_TOKEN is actually valid or correctly scoped — that gap is deliberately left to a strictly opt-in flag on init rather than folded into doctor, because doctor has a documented no-network invariant that must not be broken. This issue adds that single, explicit, operator-triggered network check.

Dependencies

None — independently shippable. This is deliberately kept separate from the offline doctor-credential-check issue in this batch (C18) so that doctor never makes a network call; do not merge this flag's logic into doctor itself.

Requirements

1. Add a new --verify-token flag to the init command, strictly opt-in (default off) and never added to doctor.
2. When the flag is passed, make exactly one GitHub API call to validate the token — e.g. GET /user, or reading the X-OAuth-Scopes response header from an existing authenticated call — to confirm both validity and scope.
3. On success, report the confirmed scopes/validity to the operator in a clear, human-readable line.
4. On failure (invalid token, insufficient scopes, network error), surface a clear, actionable error message before the operator proceeds to run discovery/attempts with a bad token.
5. When the flag is omitted, init's behavior must remain byte-for-byte unchanged from today (no network call, no new output).
6. This change must not touch doctor's no-network contract in any way — doctor continues to make zero API calls regardless of this flag's existence.

Deliverables / Acceptance Criteria

• --verify-token flag added to init, opt-in and off by default
• Exactly one GitHub API call made when the flag is passed, validating token scope/validity
• Clear success and failure messaging implemented
• Confirmed init without the flag makes zero network calls (unchanged from today)
• Confirmed doctor is untouched by this change

Test Coverage Requirements

This PR must ship with full test coverage for every changed line and branch — the repo's Codecov patch gate requires 99%+ coverage and the house standard is to aim for 100%, including both sides of every conditional/nullish-coalescing branch introduced. Add: (1) unit tests covering the flag's success path (valid, sufficiently-scoped token), failure paths (invalid token, insufficient scopes, network/API error), and the no-flag path (confirms zero network calls are made), (2) an invariant test asserting init without --verify-token never makes a network call, and (3) a regression test if this is framed as closing a gap where operators previously discovered bad tokens only after a live attempt failed.

Codecov visibility note: packages/gittensory-miner/**, apps/gittensory-miner-ui/**, and apps/gittensory-miner-extension/** currently sit entirely outside vitest's coverage.include glob, so codecov/patch cannot measure changes there yet — closing that gap is exactly what #4864 and #4865 (in this same milestone) do. Any part of this change under packages/gittensory-engine/src/** or the repo's own src/** remains fully Codecov-instrumented as usual. Either way, this does not lower the bar: treat the 100%-including-invariants-and-regression target above as the enforced house standard regardless of what Codecov can currently see, and it becomes gate-enforced for real once #4864/#4865 ship.

Expected Outcome

An operator can run gittensory-miner init --verify-token once during setup and immediately learn whether their GITHUB_TOKEN is valid and correctly scoped, instead of finding out only when a live discovery/attempt run fails.

Links & Resources

• packages/gittensory-miner init command implementation
• See C18 (the offline doctor-credential-presence counterpart in this same batch — deliberately kept separate)
• Theme: Claude/Codex self-host operational parity

[linear-code]

JSO-3708