fix: refresh cross-repository authentication

[PANDAJSR]

Summary

• refresh SECTL_SECAGENT_GITHUB_TOKEN without a trailing newline
• remove invalid Git config environment injection from the OpenCode action
• keep GH_TOKEN available for cross-repository GitHub CLI operations

The latest run failed before OpenCode started with HTTP 401: Bad credentials in gh repo view. The repository secret had been written through a pipeline that could preserve an invalid credential value. The secret has now been rewritten from the active GitHub credential and verified against SECTL/secagent-official-relay.

The previous GIT_CONFIG_VALUE_0 injection was also removed: it passed a raw token in a Git header without the required base64 encoding and could corrupt the action environment. OpenCode's own token mode handles the primary repository authentication; cross-repository Git operations use GH_TOKEN and gh auth setup-git in the runner.