fix: isolate Symphony GitHub token

docs/symphony-github-issues.md

@@ -31,9 +31,9 @@ explicitly request rework after review.
 - Install Git, and configure SSH access that can push to
   `git@github.com:dapi/memory-bank.git`.
 - Install and authorize `direnv` for this repository's `.envrc`.
-- Create a GitHub token with access to this repository's issues and pull
-  requests. Symphony uses it to poll the tracker; the agent uses its authenticated
-  `gh` CLI for GitHub reads and updates.
+- Provide a GitHub token for Symphony's tracker as `SYMPHONY_GITHUB_TOKEN`.
+  If it is absent, `.envrc` uses `gh auth token` for the tracker. The agent
+  continues to use its authenticated `gh` CLI for GitHub reads and updates.
 - Install `mise`; the bootstrap script installs the required Elixir/Erlang
   versions.
 
@@ -45,9 +45,8 @@ cp .env.local.example .env.local
 direnv allow
 ```
 
-It expects the GitHub token at `pass:github/homebrew-token`. If the local
-password-store layout differs, change only the ignored `.env.local`; never add
-the literal token to a tracked file.
+Set `SYMPHONY_GITHUB_TOKEN` in the ignored `.env.local`; never add the literal
+token to a tracked file.
 
 ## Run
 

template/.envrc

@@ -2,7 +2,11 @@ set -a
 test -f .env.local && . .env.local
 set +a
 
-export GITHUB_TOKEN="$(gh auth token)"
+if [[ -z "${SYMPHONY_GITHUB_TOKEN:-}" ]]; then
+  SYMPHONY_GITHUB_TOKEN="$(gh auth token)"
+fi
+
+export SYMPHONY_GITHUB_TOKEN
 
 symphony_origin_url="$(git config --get remote.origin.url)"
 

template/WORKFLOW.md

@@ -1,6 +1,8 @@
 ---
 tracker:
   kind: github
+  provider:
+    token: $SYMPHONY_GITHUB_TOKEN
   active_states:
     - open
   terminal_states: