fix: authenticate OpenCode cross-repository pushes

[PANDAJSR]

Summary

• verify the private relay repository is reachable with the cross-repository token
• configure Git credentials from SECTL_SECAGENT_GITHUB_TOKEN before OpenCode starts
• preserve GITHUB_TOKEN for primary repository Actions API operations and GH_TOKEN for target repository Git/CLI operations

Root cause

The latest retries could inspect and edit external repositories, but failed while pushing the generated branch:

fatal: Authentication failed for https://github.com/SECTL/SecAgent/

GH_TOKEN was present for the agent process, but Git did not have a credential helper/header configured for its automatic push. This change configures authenticated Git in the runner before OpenCode starts.

Validation

• SECTL_SECAGENT_GITHUB_TOKEN can access SECTL/secagent-official-relay
• workflow YAML parsed successfully
• git diff --check passed