DL-562

The git credential broker partitions an agent’s grants by repository owner and mints one token per owner on that owner’s App installation, keeping per-key caching, refresh and revoke; the owner-grants fallback (widen only) and DL-466’s last-key fallback both apply per owner

Status: Active (Matt, 2026-10-18)