GET /user answers 403 "Resource not accessible by integration" for App installation tokens (ghs_, the GITHUB_TOKEN every Actions job exports), so `hermes doctor` in CI painted a valid token red. /rate_limit is reachable by every token type, still 401s on a bad token, and does not count against the quota. Stand-in replays GitHub's documented 403 for ghs_ on /user; new test red before.