feat: distinguish failures by exit code and add --exec to the CLI

[jferrl]

Summary

Every CLI failure exits 1 today, so a caller cannot tell a rate limit from a
revoked key from an installation that does not exist, and retries all of them.
The library makes that unavoidable: only throttling has a typed error, and every
other rejection collapses into a string the CLI would have to pattern-match.
This adds APIError to the library, an exit code per failure class to the CLI,
and --exec, which hands the credential to a command instead of printing it
where a log or an agent transcript will keep it for the hour it stays valid.

Changes

• APIError{StatusCode, Message} replaces an untyped fmt.Errorf for every non-throttling rejection. Error() renders the identical string, so existing callers keep working.
• Exit codes: 2 bad invocation, 3 credential or permissions refused, 4 rate limited, 5 App not installed there. Documented in githubauth help.
• --exec -- <cmd> runs a command with the token in $GITHUB_TOKEN, prints nothing, and exits with the command's own code.
• Under --json or a detected coding agent, a failure is one githubauth.error JSON document on stdout with stderr silent, carrying exit_code, status_code, retry_after_seconds and suggestions.

Rationale

Agent mode changes errors only. Grafana's gcx
flips its default output format on detection, which works because its output is
data; ours is a credential meant for $(githubauth token), and flipping it would
make the README's own curl example send a JSON object as the bearer token inside
an agent session.

Migration Notes

• The CLI exit codes are a behaviour change: a script testing $? -eq 1 now sees 2, 3 or 5 for some failures. The library change is additive.
• A test suite that shells out to githubauth from inside a coding agent should set GITHUBAUTH_AGENT_MODE=0. This repo's own suite needed it — the tests inherited CLAUDECODE=1 and found errors on stdout.
• CHANGELOG.md is untouched, since this repo cuts it at release time.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 96.71053% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.75%. Comparing base (50b8e00) to head (bf40e4f).

Files with missing lines	Patch %	Lines
cmd/githubauth/errors.go	97.33%	2 Missing ⚠️
cmd/githubauth/main.go	95.74%	2 Missing ⚠️
cmd/githubauth/exec.go	94.44%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #75      +/-   ##
==========================================
- Coverage   96.96%   96.75%   -0.22%     
==========================================
  Files           5        8       +3     
  Lines         462      586     +124     
==========================================
+ Hits          448      567     +119     
- Misses         14       19       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.