GitHubAuth resolved the .env PAT first and latched it for the process; GitHub's
401 Bad credentials was returned to callers as a plain miss, so every
GitHub-backed install failed even when `gh auth login` worked or the repo was
public, and the CLI blamed a "stale index entry".
- GitHubSource._github_get: on a 401 for the credential it sent, mark it
rejected and replay the same request (caller headers kept) with the next
method, ending anonymous.
- GitHubAuth: skips rejected tokens/methods; records a label per rejection.
`gh auth token` now goes through git_credentials._gh_cli_token, which strips
GH_TOKEN/GITHUB_TOKEN so gh returns its keyring login instead of echoing
the dead env token back.
- _print_fetch_failure: names the rejected credential and never calls such a
failure a stale index entry.
Credit: @easonlao's #46402 proposed the same fallback against the pre-split
tools/skills_hub.py.
351e5f05a0