[matteius]

Summary

• Supply the DigitalOcean issue agent with the short-lived GitHub Actions token scoped to this repository.
• Keep the credential that opens pull requests on the Actions runner after the agent pushes its branch.
• Update the agent prompt and operator guide for the two-step handoff.

Why

The initial workflow passed a broader GitHub CLI credential into a session that reads public issue content. This follow-up keeps that credential out of the agent workspace while preserving the issue-to-PR flow. The repository's current policy prevents the built-in Actions token from opening PRs, so the runner opens the PR after the agent finishes.

Verification

• GitHub Actions workflow YAML parsed with PyYAML.
• DigitalOcean manifest validated with placeholder environment values.
• git diff --check passed.
• Existing CI should exercise the pull request before merge.

Rollback

Revert this PR and leave HARNESS_AUTOMATION_ENABLED unset.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!