Wire the gh-proxy integration harness into CI and close the known test gaps

[dtump]

Follow-up from the review of #7. Highest-leverage item: it turns "verified manually on one maintainer's Mac" into "verified on every PR".

Wire it into CI

tests/gh-proxy-integration.sh is credential-free (fake token + mock GitHub upstream) and CI already has a docker-capable Linux runner that builds the image for the smoke matrix — but the harness is not run in CI at all today. Add it alongside the smoke matrix.

Important: the harness currently exit 0s with a SKIP when no docker daemon is present. That is right for a dev laptop but a footgun in CI, where it would report green having tested nothing. Add a strict/required mode (e.g. --require-docker) for the CI invocation.

Close the coverage gaps

• gh config masking (task 2.8) — nothing asserts /root/.config/gh is empty while the sidecar is active. Verified manually many times; never automated.
• Fail-closed paths — only the bad-image scenario is covered. The CA-extraction timeout and the empty-sidecar-IP paths are untested.
• Sidecar-exited-during-startup path — new in feat: isolate the GitHub token in a per-session auth-proxy sidecar (--gh) #7 (detects an early Caddy exit and prints its logs); should be covered by feeding a deliberately invalid CLAUDE_DOCKER_GH_POLICY snippet.
• Vacuous assertion — tests/gh-proxy-integration.sh:475-476 runs git ls-remote and then passes unconditionally, inflating the count by one. The real assertion is the host-side mock-log check; make the in-container line assert something or drop it.

Note

The review that prompted this also claimed "no shellcheck in CI" — that is incorrect: .github/workflows/ci.yml runs ludeeus/action-shellcheck (severity warning, blocking) over the whole repo.