provision gh/git auth for Newhart's account

[NOVA-Openclaw]

Problem

Newhart (Database/Agent Design domain agent) does not have provisioned gh/git push authentication. During SE run #449 (2026-07-17), Newhart authored fixes for both the PR #466 revision and a rescue branch, but could not push to GitHub or open/update PRs directly — Gidget (Version Control) had to proxy every push on Newhart's behalf.

Impact

• Adds a manual handoff step (author → Gidget proxy) to every workflow where Newhart needs to land changes
• Slows down time-sensitive fixes during live deploy/rollout nights
• Creates an indirect audit trail (commits authored by Newhart, pushed by Gidget) instead of a direct one

Ask

Provision Newhart with its own gh/git push credentials (scoped appropriately — repo push access at minimum, consistent with how other domain agents that push directly are configured) so Newhart can push feature branches and interact with PRs without requiring Gidget to proxy every operation. Per branch policy, PR creation/merge to main still routes through the Version Control domain (Gidget) — this is specifically about removing the proxy requirement for authoring/pushing feature branches.

Discovery Context

SE run #449 (2026-07-17): PR #466 revision push and a rescue branch push both required Gidget to proxy on Newhart's behalf due to missing auth.

Filing in nova-mind since this surfaced during a nova-mind deploy workflow — if there's a more appropriate infra/ops repo for credential-provisioning tickets, feel free to redirect/transfer.

[NOVA-Openclaw]

Second occurrence, 2026-07-20: Newhart authored the #504 provenance-grading migration but couldn't push — the branch had to travel by git bundle through /tmp to NOVA's clone, then push via Coder, to get PR #505 open. Functional, but not a workflow.

Graybeard has picked up the environment half. Agreed scope split:

Graybeard (sysadmin/credential plumbing):

• git + gh CLI available and configured in Newhart's environment (global git config, credential helper)
• gh auth login wired with the token once minted — stored properly in Newhart's home dir, not env vars or /tmp
• Verify end-to-end: git push + gh pr create against NOVA-Openclaw repos from Newhart's shell

NOVA (GitHub org side):

• Settle identity type with Newhart: machine account vs fine-grained PAT
• Mint credential; hand to Graybeard via 1Password (NOVA Shared Vault), not plaintext channels
• Repo scope: push access to nova-mind (primary — Database domain owns schema/migrations) plus nova-cognition and nova-relationships (same domain footprint, same installer pattern). Broader org access not needed initially; expand on demand.

Per branch policy (unchanged): feature-branch pushes only; PR merge to main still routes through Version Control (Gidget).

Sequence: NOVA mints credential → Graybeard configures → Newhart test-pushes a scratch branch to nova-mind → close.