fix(cloud-agent): use refreshed token for signed commits

[tatoalo]

Problem

Why: Long-running cloud agents need signed commits to use credentials refreshed after the agent process starts.

Changes

Read GitHub credentials from the dedicated live credential file while keeping general sandbox metadata resolution unchanged.

[trunk-io]

😎 Merged directly without going through the merge queue, as the queue was empty and the PR was up to date with the target branch - details.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit b593418.}

[github-actions]

Straightforward fix that points signed commits to a dedicated credential file. No logic changes, no security issues, no API contract changes.

[greptile-apps]

Security Review

Mixed-version sandbox deployments can fall back to a stale process-start GitHub token when /tmp/agent-github-env is unavailable. This can cause a signed commit to use the previous actor's credentials after an actor change.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
packages/agent/src/utils/github-token.ts:10
**Missing Live File Reuses Stale Token**

When a sandbox deployment still writes refreshed credentials only to `/tmp/agent-env`, this new default misses the live file and silently falls back to the process-start token. After credentials rotate or the GitHub actor changes, signed commits can use the expired or previous actor's token instead of the refreshed credential.

_{Reviews (1): Last reviewed commit: "chore(cloud-agent): organize imports" | Re-trigger Greptile}

[greptile-apps]

Missing Live File Reuses Stale Token

When a sandbox deployment still writes refreshed credentials only to /tmp/agent-env, this new default misses the live file and silently falls back to the process-start token. After credentials rotate or the GitHub actor changes, signed commits can use the expired or previous actor's token instead of the refreshed credential.

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/agent/src/utils/github-token.ts
Line: 10

Comment:
**Missing Live File Reuses Stale Token**

When a sandbox deployment still writes refreshed credentials only to `/tmp/agent-env`, this new default misses the live file and silently falls back to the process-start token. After credentials rotate or the GitHub actor changes, signed commits can use the expired or previous actor's token instead of the refreshed credential.

How can I resolve this? If you propose a fix, please make it concise.