feat: wire shared/github-auth.sh into all agent flows (#1216)

* feat: wire shared/github-auth.sh into all agent flows

Add offer_github_auth() to shared/common.sh and call it from the
inject_env_vars_* functions so all agent flows automatically offer
GitHub CLI setup after env var injection — no per-script changes needed.

Changes:
- shared/common.sh: add offer_github_auth() function, call it from
  inject_env_vars_ssh() and inject_env_vars_local()
- sprite/lib/common.sh: call offer_github_auth() from
  inject_env_vars_sprite()
- OVH is covered automatically (inject_env_vars_ovh delegates to
  inject_env_vars_ssh)

Behavior:
- Prompts "Set up GitHub CLI (gh) on this machine? (y/N):"
- Defaults to No (non-blocking for users who don't need it)
- Skippable via SPAWN_SKIP_GITHUB_AUTH=1 env var for CI/automation
- Uses safe_read for curl|bash compatibility
- Downloads and runs shared/github-auth.sh on the remote VM

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: add shared agent setup helpers, deduplicate hetzner scripts (#1236)

Add 5 composable helper functions to shared/common.sh (install_agent,
verify_agent, get_or_prompt_api_key, inject_env_vars_cb, launch_session)
that use the same callback pattern as offer_github_auth and
setup_claude_code_config. Refactor all 15 hetzner agent scripts to use
them, reducing total line count from 868 to 579 (-33%).

Phase 1 of multi-phase rollout — remaining clouds to follow.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cli/src/__tests__/agent-env-injection-contract.test.ts

@@ -203,10 +203,12 @@ describe("Agent Environment Variable Injection Contract", () => {
         // 2. OAuth flow: get_openrouter_api_key_oauth
         // 3. Manual prompt: get_openrouter_api_key_manual
         // 4. try_oauth_flow
+        // 5. Shared helper: get_or_prompt_api_key (wraps env check + OAuth)
         const hasEnvCheck = code.includes("OPENROUTER_API_KEY:-") || code.includes("OPENROUTER_API_KEY:=");
         const hasOAuth = code.includes("get_openrouter_api_key_oauth") || code.includes("try_oauth_flow");
         const hasManual = code.includes("get_openrouter_api_key_manual");
-        const hasAnyAcquisition = hasEnvCheck || hasOAuth || hasManual;
+        const hasSharedHelper = code.includes("get_or_prompt_api_key");
+        const hasAnyAcquisition = hasEnvCheck || hasOAuth || hasManual || hasSharedHelper;
 
         if (!hasAnyAcquisition) {
           failures.push(key + ".sh");