DL-563

Each per-owner token reaches the container as an owner-tagged SecretGH written to its own file beside a default-owner marker; a static Go helper answers git (useHttpPath) and jj-vine (tokenCommand with {project}) by repository owner, falls through to hosts.yml only for the default owner, and fails closed for any other owner without a file

Status: Active (Matt, 2026-10-18)