Fixes the template-layer half of #13. Previously initial_prompt cloned
`https://github.com/${GITHUB_REPO}.git` with no authentication, which
fails for private repos in non-TTY docker exec with:
fatal: could not read Username for 'https://github.com':
terminal prompts disabled
Now the prompt uses `https://x-access-token:${GITHUB_TOKEN}@github.com/...`
when GITHUB_TOKEN is present in env (global secret, set per CEO on 2026-04-13),
falls back to anonymous clone when it isn't.
This is a belt-and-suspenders template default. The platform-level fix
(#13) is still needed so the provisioner rewrites clone URLs
consistently, but the template should work out of the box too.
e0b76b04f4