fix(github): org repo listing fails with fine-grained PATs lacking Issues:Read

[fproulx-boostsecurity]

Problem

analyze_org fails entirely when using a fine-grained PAT (FGPAT) that doesn't have Issues: Read permission:

ERROR | failed to fetch batch of repos, skipping batch  error="Resource not accessible by personal access token"
ERROR | failed to fetch batch of repos, skipping batch  error="Resource not accessible by personal access token"
ERROR | too many consecutive batch failures, stopping pagination

Root cause: issues { totalCount } is typed IssueConnection! (non-null) in GitHub's GraphQL schema. When a FGPAT lacks Issues: Read on a private repo, GitHub cannot resolve that non-null field and nulls out the entire repo node — not just the issues field. This silently drops private repos from the batch and surfaces as a full batch failure after 3 retries.

Fix

Moves issues fetching into a dedicated issueNodes: repositories(...) GraphQL alias within the same query. The main repositories selection no longer includes issues, so all repos are always returned regardless of Issues: Read permission.

The shurcooL/graphql library unmarshals response data before returning errors. So when issueNodes gets a FORBIDDEN response, Repositories.Nodes is already fully populated — we detect this partial-success case via isIssuesPermissionError() and continue normally. Repos where Issues: Read is missing get openIssuesCount = 0 silently via repoWithIssueCount.

Also adds isFatalError() so true auth failures (bad credentials, 401/403) stop pagination immediately instead of burning through retries.

Minimum required FGPAT permissions

Permission	Required
Resource owner = target org	✅
Repository > Contents: Read	✅
Organization > Members: Read	❌ not needed
Repository > Issues: Read	❌ not needed (gracefully degraded)

Test plan

• analyze_org <org> with a FGPAT scoped to the org with only Contents: Read — all repos (including private) should be listed and scanned, with openIssuesCount: 0
• analyze_org <org> with a FGPAT that also has Issues: Read — openIssuesCount should be populated correctly for all repos
• analyze_org <org> with an invalid/expired token — should log a single fatal error and stop immediately, not retry 3 times