fix: support GH_TOKEN alongside GITHUB_TOKEN

[EYH0602]

Summary

• Add a github_token() helper that reads GH_TOKEN first, then falls back to GITHUB_TOKEN (matching the gh CLI convention; empty values are treated as unset).
• Route all auth and the star-list token read through the helper, and update user-facing tip/error messages plus README + CHANGELOG to mention both vars.
• Add unit tests covering precedence, fallback, unset, and empty-string cases.

Closes #67.

Test plan

• cargo build
• cargo test (281/281 passing, including 4 new test_github_token_* cases)
• cargo clippy --all-targets -- -D warnings clean

[fenfenai]

Review Summary

Reviewed 3 files, 83 lines changed across 4 review aspects (bug detection, error handling, test coverage, doc/guideline compliance). The core change is clean and well-tested — the findings below are a stale doc and a test-pollution regression caused by the new precedence.

Important Issues (confidence 75–89)

docs/cli-reference.md:26 — Stale CLI reference (confidence: 85)

This line still reads:

Requires GITHUB_TOKEN (GraphQL API requires authentication).

It contradicts the updated fetch_star_list_repos behavior, the README updates in this PR, and the new error message in github.rs:752. AGENTS.md asks docs to stay in sync with feature changes; the cli-reference is the canonical reference for skillshub star-list and should not be left behind.

Suggestion: Replace with: Requires GH_TOKEN or GITHUB_TOKEN (GraphQL API requires authentication). GH_TOKEN is checked first, matching the gh CLI.

(docs/git-based-taps.md:79 is fine — it explicitly describes past usage.)

src/registry/github.rs:1903 / :1949 — Test isolation regression (confidence: 88)

See inline comment.

Minor Issues (confidence 75)

src/registry/github.rs — Missing symmetric empty-string test (confidence: 75)

See inline comment.

Positive Observations

• The new github_token() helper is small, focused, and correctly implements the precedence + empty-as-unset contract.
• All four new tests use #[serial] and follow capture → cleanup → assert ordering, so a panic doesn't leak env state.
• README.md and CHANGELOG.md are updated consistently and the keep-a-changelog ### Changed entry is well-formed.
• Every user-facing error message that used to say "GITHUB_TOKEN" is now updated (get_default_branch, fetch_gist, fetch_star_list_repos, the rate-limit-tip print, and the >max wait error).
• The empty-string-as-unset behavior in fetch_star_list_repos is a real UX win: previously GITHUB_TOKEN="" slipped through and produced a confusing downstream 401; now it fails fast at the helper boundary.

Considered but did not flag

• NotUnicode env values are silently swallowed by if let Ok(token) = std::env::var(...). Pre-existing pattern — the old with_auth did the same.
• The behavior change where GITHUB_TOKEN="" no longer produces Bearer (empty) but instead falls through to anonymous requests. Observable, but a strict improvement in this codebase.
• Option::context(...) on github_token() (L751): correct — anyhow::Context provides this on Option.

[fenfenai]

Re-Review: All findings addressed ✓

Verified aa91a04 against the three open findings from the prior review:

#	Finding	Status
1	docs/cli-reference.md:26 stale doc	✓ Updated to mention both GH_TOKEN and GITHUB_TOKEN, with GH_TOKEN precedence noted.
2	Test isolation regression at :1903 and :1949	✓ Both test_fetch_star_list_repos_with_mock and test_fetch_star_list_repos_list_not_found now remove_var("GH_TOKEN") before the dummy GITHUB_TOKEN set, and clear it again on cleanup. The added clarifying comment is helpful.
3	Missing symmetric empty-string test	✓ test_github_token_treats_empty_github_token_as_unset added at L945–953, #[serial], follows the capture-then-cleanup-then-assert pattern.

No new issues introduced by the fix-up commit. LGTM.