One-click GitHub: Connect GitHub, pick a repository, the crew makes it run here - issues and open pull requests come too #3264

Owner, 2026-10-20: "something i want is one click github ... i have a repo i want to migrate in and have the crew build into the forge."

Today src/actions/migrate.ts already clones full history into a private native repo and, with a crew asked for, makes it an app and briefs the crew ("make it run here, adapting rather than rewriting"); private repos need a connected origin credential, otherwise a pasted public URL.

Done:

1. "Connect GitHub" on /migrate: GitHub OAuth (or GitHub App) sign-in - no pasted token; the credential is stored as an origin credential (origins/credentials.ts rules: header in env, never argv/URL), revocable on the page.
2. A picker of the person's repositories (owned + orgs), searchable, private ones marked, size shown; one click on a row = migrate with the crew.
3. Issues (open + closed, labels, comments, authors as "by @x on GitHub"), milestones, and open pull requests (as pull requests with their branches) are carried over; links back to the original stay in each body.
4. The job page streams progress (clone, issues, app, first crew run) and ends at the running app's URL.
5. After migrating: the GitHub repository can optionally be archived or left as a read-only mirror target (person's choice, default leave alone).

Test: a fake GitHub API seeded with a private repo, 3 issues and 1 open pull request - one click yields the repo, 3 issues, 1 pull request and a crew run on the app. Standard nouns (#3241).

Steward, from the first real run (trevato/arm, 2026-10-20): the migrate brief points the crew at main, and the owner's app lived on workbench (4 commits ahead; main was the upstream's tree), so the first run declined "There is no app on main". Part of done here: the picker shows branches with their last commit, defaults to the branch with the person's newest commits, and the crew brief names that branch.

Part 2 (#3288) is split into #3407 and #3408; both wait for this issue, so this one no longer waits for its own follow-ups.