fix: let OpenCode access private SecAgent repositories

[PANDAJSR]

Summary

• expose SECTL_SECAGENT_GITHUB_TOKEN to OpenCode as GH_TOKEN for cross-repository GitHub CLI and Git access
• verify access to the private SECTL/secagent-official-relay repository before starting the agent
• configure Git credentials from the cross-repository token
• explicitly instruct the agent to inspect and submit fixes to related private SecAgent repositories while retaining GITHUB_TOKEN for the primary issue event

Root cause

The workflow used the cross-repository secret only in the discovery step. The actual OpenCode step received only ${{ github.token }}, which is scoped to SECTL/SecAgent. Consequently, the agent could list public repositories but could not see or clone private repositories such as SECTL/secagent-official-relay.

Validation

• configured SECTL_SECAGENT_GITHUB_TOKEN on SECTL/SecAgent
• confirmed the underlying token can access SECTL/secagent-official-relay
• workflow YAML parsed successfully
• git diff --check passed