…rify entitlement 404

…de-copilot-chat path)

…ope 404

Copilot oauth from auth.json can return misleading 404 for private repos
while gh auth token succeeds on the same scoping_query. Retry once before
reporting failure; clarify error text (token scope vs bad repo param).

…#10)

- getToken() drops non-SYNC reads of token-sync-live.json / copilot-shared-token.json;
  both are now SYNC_MODE opt-in only (no stale token-sync / opencode-patches dependency)
- Default: Copilot OAuth primary -> gh fallback on scope-404 (preserves 92ce410)
- GITHUBREPO_PREFER_GH=1 reverses primary/fallback (private-repo-heavy use)
- Extract pure testable helpers (pickPrimaryToken, pickScopeFallback, isEmbeddingsScopeDenied)
  with unit tests; no live API required
- README: token-order section + troubleshooting (token bug vs bad owner/repo vs indexing limit)

Closes #10

export default { id, server: plugin } so named utility exports are not
invoked as legacy server hooks (undefined hook → Unexpected server error).

- d0d5dcb/c111133/a8c3243 already on main; bump package version
- Prod smoke: privates + microsoft/vscode-copilot-chat
- No fork rebuild required for githubrepo

….10)

- README: private search/index/shadow needs gh + repo scope
- Auth path: vanilla ~/.local/share/opencode/auth.json first
- references/future-gh-optional.md + GitHub #12
- Portable tests; clearer no-auth error

…4s private)