fix:pat-handler-transient-github-failure

[tao-hunter]

Summary

The validator PAT axon handlers (handle_pat_broadcast, handle_pat_check) now call validate_github_credentials_result() instead of the legacy validate_github_credentials() tuple wrapper, so transient GitHub /user failures preserve transient_failure instead of being collapsed into a generic error.

• Broadcast: On transient failure, the synapse is rejected with a retry-oriented message (GitHub API temporarily unavailable; retry the broadcast in a few minutes.) and does not imply an invalid PAT or surface the internal “Could not validate Github id … transiently” string.
• Check: On transient failure, the result is inconclusive: has_pat=True, pat_valid=None, and the same style of retry message for checks—aligned with CLI classification (pat_valid=None → no_response, not invalid PAT).

Related Issues

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other

Testing

• Unit tests added/updated in tests/validator/test_pat_handler.py:
  • Patches get_github_identity → GitHubIdentityResult(None, GitHubIdentityStatus.TRANSIENT_FAILURE) for broadcast and check.
  • Asserts broadcast rejection uses the user-facing retry copy (not raw validation wording).
  • Asserts PAT check: has_pat=True, pat_valid=None, retry rejection_reason.
• python -m pytest tests/validator/test_pat_handler.py — all tests pass.
• Manual testing (validator against real GitHub outage / simulated transient) — not performed in this change.

Checklist

• Code style consistent with surrounding code
• Self-review completed
• Documentation updated (N/A — behavior fix only; no user-facing doc change requested)

[anderdc]

Duplicate of #1107. The broadcast-handler branch was intentionally dropped from #1107 per maintainer review — both old and new broadcast paths reject with accepted=False and short-circuit before _test_pat_against_repo, so the added code only swaps the rejection string. Closing.