B02: Real GitHub integration sandbox

Define an isolated sandbox protocol (approved identity and permissions, access scope, mutation audit, retained fixtures) before any real GitHub mutation, then model auth/apply against a sandbox baseline with approved mixed fixture states and honest capability limits, and verify the existing project-sync workflow against real events with pagination and idempotence. No automatic deletion or weaker governance.