[Bug]: fetchPublicContributorProfile has no timeout and is unauthenticated (P2)

[JSONbored]

Problem

src/github/public.ts:58 — the two api.github.com fetches have no AbortSignal.timeout (unlike gittensor/api.ts and github/app.ts) → a half-open connection hangs the 500-login evidence loop; also unauthenticated (60/hr) so the loop exhausts the ceiling and silently returns source:unavailable.

Fix

Add AbortSignal.timeout; use GITHUB_PUBLIC_TOKEN (already in env) to lift the rate ceiling.

Acceptance

• Bounded request time; authenticated rate ceiling; degraded-evidence is signalled not silent.

[JSONbored]

Partially addressed by PR fix/reliability-hardening: the AbortSignal.timeout (the P1 hang) is done. Remaining: the GITHUB_PUBLIC_TOKEN auth-header to lift the 60/hr unauthenticated ceiling — needs threading env into fetchPublicContributorProfile through its ~8 callers, deferred to keep the reliability PR surgical. Keeping this issue open for that half.