Remove hardcoded GitHub PAT from secret handler

[Copilot]

This change remediates the selected Reachable secret finding in internal/handlers/secrets.go: a GitHub Personal Access Token shape was committed in source and exposed by a handler response. The hardcoded value is removed from the repository, and the handler now sources any runtime token from environment instead.

• Secret remediation

  • Removed the committed GitHub PAT-shaped constant from internal/handlers/secrets.go.
  • Stopped returning a source-controlled GitHub token value from CloudTokens.

• Runtime secret sourcing

  • Introduced REACH_TESTBED_GITHUB_TOKEN as the runtime source for the github_token response field.
  • Preserved existing handler shape and the AWS synthetic fixture to keep the change narrowly scoped.

• Focused coverage

  • Added internal/handlers/secrets_test.go to cover:
    • configured runtime GitHub token
    • unset runtime GitHub token

const githubTokenEnvVar = "REACH_TESTBED_GITHUB_TOKEN"

func CloudTokens(w http.ResponseWriter, _ *http.Request) {
	_ = json.NewEncoder(w).Encode(map[string]string{
		"aws_access_key_id": syntheticAWSAccessKeyID,
		"github_token":      os.Getenv(githubTokenEnvVar),
	})
}

Reachable remediation status

• RCH-RULE-b4ff9103 — fixed (internal/handlers/secrets.go)