[closer-claudio]

book/github.md said administration read for most settings, secrets read for
the secret lists and administration write for an environment, and the design
document's auth table pointed at an issue for the rest. A human minting a
token for fix --org, or extending an App for the scheduled audit, had no
list to mint from.

The Authentication section now carries one table: scope, permission, the
level check needs and the level fix needs, and what each serves, derived
from the endpoints internal/github calls and GitHub's permission reference
for fine-grained tokens (the Actions policy, vulnerability alerts, code
scanning, teams and deploy keys under repository Administration; the
environment list under Actions and an environment's secrets under
Environments; the organization's policy, configurations and installations
under organization Administration; members and teams under Members; the
agents team's grant as repository Administration write with Members read).
Two things the reference made plain: the organization's fine-grained
token inventory is served to App tokens only, so under a fine-grained
personal access token that check is unverifiable; and gh's default scopes,
repo and read:org, read the repository rows and not the organization's
governed fields.

TestAuditEndpointFamilies holds the table to the code: the endpoint
families a full compliant audit reads, names and numbers reduced to
placeholders, against a list in the test, so a new read moves the table or
fails. The writes are each asserted by the fix test that performs them.

Closes #509

Sources read live: GitHub's permission reference for fine-grained tokens (https://docs.github.com/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens), the endpoint pages for GET /orgs/{org}, GET /users/{username}, the organization's personal access token list and the team repository grant, and gh's auth login manual for its default scopes. just lint and just test green.