background lane without GH_TOKEN strands its work as an auto-commit on the target repo's local develop

[kokevidaurre]

Failure chain observed on a real background run (2026-07-14):

1. Detached background lane spawns with no `GH_TOKEN` in env → every `gh` call exits 4 (agent cannot read its assigned issue, comment, or open a PR). Likely the known silent `getBotGhEnv` fallback.
2. The lane finishes; worktree cleanup salvages uncommitted work by committing it — but the commit lands on the target repo's local checked-out branch (develop) as `squads-bot[bot]`, message `feat(/): agent work via glm`, and the worktree is removed.
3. Result: unreviewed agent code sits silently on local develop, one `git push` away from bypassing the PR/CI flow entirely. Nothing surfaces this to the operator.

Fixes needed (in priority order):

• Cleanup must never commit to a checked-out branch of the main repo: salvage to a dedicated `agent/--` branch (ref only, no checkout) and print/log the ref loudly.
• Fail loud at spawn if bot token mint fails when the agent's tools include `Bash(gh:*)` — a lane that cannot open a PR should say so at start, not waste a full run.

Repro: dispatch any `--background` lane while GitHub App token mint fails; watch `git log develop` in the target repo after cleanup.