fix: restore public file streaming and contain ZIP failures

src/core/github-token-context.ts

@@ -11,6 +11,17 @@ export function githubTokenContext(token: string) {
   if (!context && token.startsWith("public-read:")) throw new Error("Public repository access context expired");
   return context;
 }
+// Public handles belong to this process. Revalidate here, then let the
+// streamer fetch public bytes anonymously without forwarding the owner's token.
+export async function githubTokenForStreamer(token: string, repository: string | undefined): Promise<string> {
+  const context = githubTokenContext(token);
+  if (!context?.publicRepository) return token;
+  if (!repository || context.publicRepository.toLowerCase() !== repository.toLowerCase()) {
+    throw new Error("Public repository access context mismatch");
+  }
+  await context.renew();
+  return "";
+}
 export function githubQuotaKey(token: string) {
   return contexts.get(token)?.quotaKey || createHash("sha256").update(token).digest("hex").slice(0, 24);
 }