feat: add pat plugin — GitHub App installation token (no manual PAT) - #7

`pat` replaces manually-created PATs. It mints a short-lived GitHub App
installation access token (1h, fresh on every run) from a private key stored in
Bitwarden, and optionally stores it as a repo Actions secret.

Because the App is installed on the whole account, every new repo needs zero
extra steps — no more github.com/settings/tokens.

- scripts/pat.sh: CLI (install / token / grant subcommands)
- scripts/pat_lib/jwt.sh: RS256 JWT via openssl (no Python deps)
- scripts/pat_lib/bw.sh: Bitwarden unlock-if-needed + PEM retrieval
- commands/pat.md + plugin.json: /claude-tools:pat slash command
- tests: 13 new unit tests (b64url, JWT sign/structure, bw parse, argparse)

Co-Authored-By: Claude <[email protected]>

1. PEM temp-file leak. pat_get_pem_file was called via command
   substitution (`pem_file=$(...)`), running in a subshell — the
   pat_PEM_TMP assignment never reached the parent, so the EXIT trap
   saw an empty value and left every PEM file on disk. Repeated
   install/token/grant runs accumulated readable copies of the App
   private key. Replaced with pat_with_pem <var>, which sets the path
   in the calling shell (printf -v, no subshell); trap always cleans
   up. Added a leak-regression test + a guard proving the old $(...)
   pattern is still detected.

2. Master password in argv. `bw unlock --raw "$pw"` exposed the
   Bitwarden master password to `ps` / /proc while bw ran. Switched to
   stdin (`bw unlock --raw < <(printf '%s\n' "$pw")`) and clear the
   variable immediately after.

Verified: 15/15 tests pass (added 2). Manually confirmed the leak was
real — 8 stale PEM copies found in $TMPDIR from earlier runs, deleted.

Co-Authored-By: Claude <[email protected]>

Three FIX items from the Claude subagent review:

1. pat_resolve_repo: lazy quantifier [^/]+? is invalid on BSD sed (macOS
   default) — every `grant` relying on git-origin auto-detection failed.
   Switched to greedy [^/]+ and a second sed to strip a trailing .git.
   Added URL-normalization tests (ssh/https, with/without .git).

2. Made jq a hard dependency (pat_require_deps) and removed the BSD-incompatible
   awk fallback (gawk-only match($0,re,arr)) and the injectable python3
   fallback in pat_bw_get_field. jq is already required everywhere; the
   fallbacks were dead code that broke on macOS and added an injection surface.

3. PEM leak in piped callers — the real root cause. cmd_token ran
   pat_fresh_token | cut and cmd_grant used pair=$(pat_fresh_token); both
   execute the function in a SUBSHELL whose EXIT trap (bash 3.2 on macOS)
   does not reliably clean up the PEM temp file. Replaced with
   pat_fresh_token_into <tok_var> <exp_var> (printf -v, no subshell) so the
   trap always runs in the shell that created the file. Verified live: 0
   leftover PEM files across token+grant+install.

Verified: 18/18 tests pass (added 3 URL-normalization tests). shellcheck clean.

Co-Authored-By: Claude <[email protected]>

- gh secret set: pass the installation token via STDIN instead of --body,
  so it never appears in the `gh` process argv (ps-visible while gh runs).
- pat_fresh_token_into: drop `local token expires` — those are the CALLER's
  variables (named by $_tok_var/$_exp_var, set via printf -v). Declaring
  them local shadowed the caller's vars, so expires_at never reached
  cmd_grant (printed "valid until" empty). pem_file/jwt/inst_json stay local.

Verified live: grant prints real expiry, token still minted (40 chars),
18/18 tests.

Co-Authored-By: Claude <[email protected]>