Scrub GitHub and GitLab authentication token aliases (#119)

#### Context

GitHub and GitLab authentication aliases let coding agents inherit
tracker credentials and bypass Symphony's host-side boundary.

Thanks @genforAI for reporting this issue.

#### TL;DR

*Keep GitHub and GitLab authentication-token aliases out of coding-agent
environments.*

#### Summary

- Scrub GitHub CLI token aliases in the existing GitHub provider client.
- Scrub GitLab access-token aliases while preserving distinct CI job
credentials.
- Document provider credential isolation, current authentication
guidance, and existing adapter test coverage.

#### Alternatives

- Fix GitHub only; rejected because GitLab exposes the same
authentication-alias weakness.
- Add another child-process test; existing launcher-isolation coverage
already verifies that boundary.

#### Test Plan

- [x] `make -C elixir all` (296 tests, 0 failures, 100% coverage)
- [x] Focused GitHub, GitLab, and existing app-server
credential-isolation tests

---------

Co-authored-by: Codex <codex@openai.com>