Add a github-app connection whose tokens gete issues itself

[haruotsu]

Summary

Adds github-app, a catalog connection whose tokens gete issues itself from a GitHub App's private key, instead of receiving a user's token from Gemini Enterprise. Agents use it from ordinary openapi blocks (and python tools through ConnectionClient), so operations, params, does_not, and the host check apply exactly as they do today.

# gete.yaml
connections:
  github-app:
    base_url: https://ghe.example.com/api/v3   # leave out for github.com
    app:
      app_id: "123"
      private_key_secret: ge-github-app-private-key
      # The ceiling of every token issued through this connection
      repositories: [example-org/requests]
      permissions: {issues: read}

# agent.yaml
connections: [github-app]
tools:
  - openapi:
      spec: ./specs/github.yaml
      connection: github-app
      effect: read
      operations: [SearchIssues, GetIssue, ListIssueComments]
      params:
        SearchIssues:
          q: {prefix: "repo:example-org/requests is:issue "}

What gete does for such a connection

• Signs an App JWT (RS256, iat backdated 60s, valid for under 10 minutes) and finds the installation from the first permitted repository the App is installed on (GET /repos/{owner}/{repo}/installation).
• Issues a narrowed installation token (POST /app/installations/{id}/access_tokens with repositories and permissions) and reuses it in-process until 5 minutes before expires_at. A 401 from the service drops the cached token so the next request gets a fresh one.
• Creates no Gemini Enterprise authorization. register skips the connection, --reset-authorization does not accept it, and no reauthorization tool is offered. A missing key or a refused issue is reported to the user as text (status code only; response bodies and key contents never appear).
• Delivers the private key like secret_env. private_key_secret is wired into the Terraform module call as GETE_APP_KEY_<CONNECTION>, which the agent may not set itself; validate --check-secrets checks it. The App ID and the ceiling travel in the resolved declaration.

Schema and validation

• A connection now declares exactly one of oauth or app.
• The catalog entry leaves app open (like {base_url}); validate refuses an agent holding it until app_id, private_key_secret, repositories, and permissions are set. permissions is required so a token never carries the installation's whole grant.
• repositories must share one owner, since a token comes from one installation.
• Scope selections and mcp blocks on an app connection are refused. MCP is left for a follow-up: ADK reads MCP headers synchronously, while issuing a token is a request of its own.

Other changes

• gete connections github-app describes the App, key secret, delivery variable, and ceiling instead of OAuth client details.
• gete run no longer asks for GETE_TOKEN_* for app connections; the issuer reads the PEM from GETE_APP_KEY_*.
• cryptography is declared as a direct dependency (already installed through ADK) since gete now signs the JWT itself.

Test plan

• uv run pytest (934 passed)
• uv run mypy
• uv run ruff check / uv run ruff format --check

[haruotsu]

Pushed ddbd9f5 with three follow-ups:

• gete graph marks app connections as (bot). An app connection acts as the App for whoever calls the agent, like a shared credential, so it no longer reads as if it carried the caller's authorization. Both the edge to its tools and the node of an unused connection are marked.
• The App's key is taken out of the environment. The key can issue a token with the installation's whole grant, above the declared ceiling. When the agent is built, before its own modules are imported, gete moves GETE_APP_KEY_* out of os.environ and keeps it inside the issuer, so tools reading their settings and processes they start no longer find it. This is not isolation from code in the same process; the README now says so and asks to keep the App's own grant minimal.
• app_id may be written unquoted. YAML reads a bare ID as a number; the schema now accepts a positive integer as well as a digit string, and the loader already turned it into a string.

uv run pytest (944 passed), uv run mypy, uv run ruff check, uv run ruff format --check all pass.