collect_acceptance's gh api subprocess inherited the calling process's
environment, so on a multi-profile host the gate read the contract repo as
the ambient (launch/default) gh login: a private repo in another org
returned 404 and the broad except classified it infra with 'check gh
authentication and retry', blocking green cards and holding them via the
blocker_auth respawn guard (#122689).
- Thread the assignee's profile home into every _api call and build the
child env with served_profile_child_env(inherit_credentials=True): the
profile's own GH_TOKEN/GH_CONFIG_DIR overlay, launch credential residue
scrubbed (GH_CONFIG_DIR is a path, not a credential, so no scrub list
saw it — drop it from the base for routed targets).
- Classify a refused read (gh HTTP 401/403/404, or GraphQL resolving the
repository to null) as 'auth' naming the repository, distinct from
retryable infra; persist only the status code + endpoint, never stderr.
- Unassigned/uninstalled cards and single-profile hosts keep the ambient
env, unchanged.
Fixes#122689
fdac8a1896